|
| 1 | +.. _hub/admin: |
| 2 | + |
| 3 | +Admin |
| 4 | +===== |
| 5 | + |
| 6 | +.. _hub/admin/license: |
| 7 | + |
| 8 | +License |
| 9 | +------- |
| 10 | + |
| 11 | +Every Cryptomator Hub instance requires a license. |
| 12 | +The license is bound to the instance and cannot be transferred to another instance. |
| 13 | +Every license has a number of seats and a validity period. |
| 14 | +As an Hub administrator, you can view license information in the administration area. |
| 15 | + |
| 16 | +.. image:: ../img/hub/admin-area-license.png |
| 17 | + :alt: Administration area |
| 18 | + |
| 19 | +.. _hub/admin/license/seat: |
| 20 | + |
| 21 | +What is a Seat? |
| 22 | +^^^^^^^^^^^^^^^ |
| 23 | + |
| 24 | +A regular license contains a fixed number of *seats*. |
| 25 | +A *seat* is taken for every user, which is assigned to at least one, not-archived vault. |
| 26 | +Note that: |
| 27 | + |
| 28 | +* If a user is not assigned to any vault, it *does not occupy* a seat. |
| 29 | +* If a user is assigned to multiple vaults, it only *occupies one* seat. |
| 30 | +* If :ref:`a user is created or imported to Hub <hub/user-group-management>`, it does not occupy a seat. |
| 31 | + |
| 32 | +.. note:: Enterprise licenses can have an unlimited number of seats. Visit `cryptomator.org <https://cryptomator.org/hub/>`_ for more information. |
| 33 | + |
| 34 | +.. _hub/admin/license/community-license: |
| 35 | + |
| 36 | +Community License |
| 37 | +^^^^^^^^^^^^^^^^^ |
| 38 | + |
| 39 | +When you deploy Cryptomator Hub by yourself, it comes with a community license with life-long validity and 5 seats. |
| 40 | + |
| 41 | +.. _hub/admin/license/buy-license: |
| 42 | + |
| 43 | +Updating your License |
| 44 | +^^^^^^^^^^^^^^^^^^^^^ |
| 45 | + |
| 46 | +If the community license is not sufficient for your needs, you can upgrade it to a paid license. |
| 47 | +You can also upgrade an already existing, paid license. |
| 48 | +To do so, click on the button in the lower right corner of the administration area. |
| 49 | +It will redirect you to the Cryptomator Hub license store. |
| 50 | +After the purchase, you will be automatically redirected back to your Hub instance. |
| 51 | + |
| 52 | +.. _hub/admin/audit-logs: |
| 53 | + |
| 54 | +Audit Logs |
| 55 | +---------- |
| 56 | + |
| 57 | +The Audit Logs provide an overview of security-related events within Cryptomator Hub. |
| 58 | +These logs allow administrators to track important account and vault-related actions. |
| 59 | + |
| 60 | +.. note:: |
| 61 | + Audit Logs are not available with a Community License. |
| 62 | + |
| 63 | +Event Types |
| 64 | +^^^^^^^^^^^ |
| 65 | + |
| 66 | +The following events are logged: |
| 67 | + |
| 68 | +Device |
| 69 | +""""""" |
| 70 | + |
| 71 | +- **Register Device** - A user :ref:`registered a new device <hub/access-vault/unlocking-a-vault/add-device>`. This can be e.g. a Cryptomator app (desktop/mobile) to unlock a vault or a web browser to access Cryptomator Hub. |
| 72 | +- **Remove Device** – A user :ref:`removed a device <hub/your-account/profile/authorized-devices>`. |
| 73 | + |
| 74 | +Web of Trust |
| 75 | +"""""""""""" |
| 76 | + |
| 77 | +- **Signed Identity** – A user :ref:`signed the identity of another user <hub/vault-management/wot>`. |
| 78 | +- **Update Wot Setting** – A user updated :ref:`Web-of-Trust settings<hub/vault-management/wot>`, e.g. the ``wot_max_depth``. |
| 79 | + |
| 80 | +Vault |
| 81 | +"""""" |
| 82 | + |
| 83 | +- **Add Vault Member** – A vault owner :ref:`added a member to a vault <hub/vault-management/add-user>`. This only adds the member but does not derive the vault key for the new member. |
| 84 | +- **Create Vault** – A user :ref:`created a vault <hub/vault-management/create-vault>`. |
| 85 | +- **Grant Vault Access** – A user :ref:`derived the vault key for the new member <hub/vault-management/updating-permission>`. |
| 86 | +- **Retrieve Vault Key** – A user retrieved a vault key. This happens when a user :ref:`unlocks a vault <hub/access-vault/unlocking-a-vault>` but also e.g. when a owner manages the vault. The IP address and device information are optional for legacy reasons. |
| 87 | +- **Remove Vault Member** – A vault owner removed a member from a vault. |
| 88 | +- **Update Vault Member** – A vault owner :ref:`changed a member’s role <hub/vault-management/change-ownership>` (owner or user). |
| 89 | +- **Update Vault** – A vault owner :ref:`updated the vault metadata <hub/vault-management/edit-vault-metadata>`. This includes the vault name or description. |
| 90 | + |
| 91 | +Account |
| 92 | +"""""""" |
| 93 | + |
| 94 | +- **Account Key Changed** – A user :ref:`re-generated the account key <hub/your-account/profile/regenerate-account-key>`. This also logs ``User Keys Change`` because changing the account key also changes parts of the user keys. |
| 95 | +- **Reset User Account** – A user :ref:`resetted it's account <hub/your-account/reset-account>`. |
| 96 | +- **User Keys Change** – A user changed it's keys. This happens when e.g. the user :ref:`finished the account setup <hub/your-account/setup>` or when the ``Account Key Changed``. |
| 97 | + |
| 98 | +Legacy |
| 99 | +"""""" |
| 100 | + |
| 101 | +- **Claim Vault Ownership** – A user claimed vault ownership. This event is logged when a vault created with hub pre 1.3.0 is claimed by the vault creator using the `Vault Admin Password`. |
| 102 | + |
| 103 | +.. _hub/admin/audit-logs/table-view: |
| 104 | + |
| 105 | +Audit Log Table View |
| 106 | +^^^^^^^^^^^^^^^^^^^^ |
| 107 | + |
| 108 | +The logs are displayed in a structured table containing the following columns: |
| 109 | + |
| 110 | +- **Timestamp** – The exact time of the event. |
| 111 | +- **Event** – The type of event that occurred. |
| 112 | +- **Details** – Additional information about the event. |
| 113 | + |
| 114 | +.. image:: ../img/hub/auditlogs-overview.png |
| 115 | + :alt: Audit Logs Table View |
| 116 | + |
| 117 | +.. _hub/admin/audit-logs/filters: |
| 118 | + |
| 119 | +Filtering Audit Logs |
| 120 | +^^^^^^^^^^^^^^^^^^^^ |
| 121 | + |
| 122 | +To refine the displayed logs, a filtering function is available: |
| 123 | + |
| 124 | +.. image:: ../img/hub/auditlogs-filter.png |
| 125 | + :alt: Audit Log Filtering Options |
| 126 | + |
| 127 | +- **Date Range Filter**: Allows filtering logs between two specific dates. |
| 128 | +- **Event Type Filter**: A multi-select dropdown enables filtering by event type. |
| 129 | + |
| 130 | +.. image:: ../img/hub/auditlogs-filter-events.png |
| 131 | + :alt: Audit Log Filtering Options |
| 132 | + |
| 133 | +.. _hub/admin/wot: |
| 134 | + |
| 135 | +Web of Trust |
| 136 | +------------ |
| 137 | + |
| 138 | +The Web of Trust (WoT) feature in Cryptomator Hub helps users verify each other's identity by signing the :ref:`User Key Pair <security/hub/keys/user-keys>` with their private keys using ECDSA. |
| 139 | +First, the trusting user needs to verify the trustee by entering the first characters of the trustee's public key fingerprint. Once signed, the proof is uploaded to Hub, where others can check its authenticity. |
| 140 | + |
| 141 | +WoT also supports transitive trust, meaning if Alice trusts Bob, and Bob trusts Charlie, then Alice implicitly trusts Charlie. This forms a trust chain, allowing users to establish indirect trust relationships. |
| 142 | + |
| 143 | +.. image:: ../img/hub/wot-admin.png |
| 144 | + :alt: Audit Log Filtering Options |
| 145 | + |
| 146 | +**In the administration area, administrators can configure the following trust settings:** |
| 147 | + |
| 148 | +The maximum depth of such chains can be configured using the **Maximum WoT Depth** property: |
| 149 | + |
| 150 | +* The default value is 3 ("Great-Grandchild") |
| 151 | +* The maximum value is 9 |
| 152 | +* The minimum value, 0, means no trust chain is allowed, only direct trust relationships are considered. |
| 153 | + |
| 154 | +With the **Fingerprint Verification Preciseness** property, the minimum length of the entered public key fingerprint can be configured: |
| 155 | + |
| 156 | +* The default value is 2 |
| 157 | +* The minimum value, 0, means the fingerprint of the trustee is fully shown without any input needed. |
| 158 | + |
| 159 | +.. note:: |
| 160 | + |
| 161 | + If a user resets their account, their :ref:`User Key Pair <security/hub/keys/user-keys>` is regenerated, invalidating all previously established trust relationships regarding this user. |
| 162 | + Additionally, any existing trust chains that included the user will be broken, requiring re-verification to restore trust. |
0 commit comments