[SOLVED] Restricting Admins

[bubarooni]

Hi,

Running Release 6.0.2_GA_1912.RHEL5_20091020173119 RHEL5 NETWORK edition on RHEL.

I'm seeking a way to allow two people to do general admin things like create and delete accounts, reindex boxes, search a mailbox or deleted folder, etc. They can share the account.

What I want to prevent them from doing is opening someone else's mailbox and rummaging around for whatever interests them.

How would I go about this? Is there a preset group in the Global ACL section that would accomplish that?

Thanks In Advance

[bdial]

have you looked at the admin docs for delegated administration?

Delegated Administration

[bubarooni]

nope!

and that's exactly the kinda link i was looking for.

Thanks!

[bubarooni]

I am sure that somewhere in that doc is the info I need, but jeez..., I ain't seeing it.

I just want to create a group that can enable basic admin tasks such as deleting an existing user account, creating a new user account, assigning the account to a distribution list, create an alias for the new account, etc.

Then I want to assign the two people who work for me to this group and have them take care of these day to day tasks.

This will allow me to tell my boss it's taken care of and then I can move on to the other pressing issues of the day such as why Jodie has a bigger LCD monitor than Laurie.

I just ain't seeing how to do this in that document...

[LMStone]

Try this:

User:Vladimir-DomainAdminSetup-v6 - Zimbra :: Wiki

Hope that helps,
Mark

[bubarooni]

OK, maybe I'm making rocket science out of this because I have no rocket fuel.

When I look under 'Admin Extension' I see an Extension called com_zimbra_delegatedAdmin. I have an option to deploy, but undeploy is grayed out.

Does that mean my extension is just not available and that if I deploy it, I'll have the tool I need to make this a snap?

[LMStone]

Originally Posted by bubarooni

OK, maybe I'm making rocket science out of this because I have no rocket fuel.

When I look under 'Admin Extension' I see an Extension called com_zimbra_delegatedAdmin. I have an option to deploy, but undeploy is grayed out.

Does that mean my extension is just not available and that if I deploy it, I'll have the tool I need to make this a snap?

No, what you are seeing is fine and normal; the extension is already deployed as part of a Network Edition install.

Hope that helps,
Mark

[bubarooni]

It sure does.

I'm going thru that link you posted above as it looks like EXACTLY what I am after.

It's not doing what I want yet, even after a start and stop of the server though. I assigned myself to a new distribution list called mail_admins and then applied the views and grants as detailed in the link, but I'm still seeing all the admin functions when I click the link 'Domain Admins' in my own mail account.

I think it's just a matter of time before I hit paydirt though. Thanks for the link!

[bubarooni]

To quote a line out of the link you posted:

Woo Hoo!!!

That is pretty darn close to perfect as far as what I am looking to do. It now looks exactly like your link in that only the Addresses and Searches show up on the left hand side of the admin screen when logging in with the DL rights.

One last question though. The 'Search Mail' icon is still available to me as the jr mail admin. What is the grant called that will eliminate that from the distribution list I created?

[bubarooni]

actually, though the 'Search Mail' button is not grayed out, I'm unable to select a server to search so it's not usable. I think it works!

I actually ran a command from the CLI, grep delegateAuth, that shows no one has ever searched a mailbox and now the only way is for me to do it thru the actual admin login.

Anyway, I can tell my boss all is well and I can get back to dealing with LCD Monitor Envy Syndrome.

Thanks for all your help!!!