Accounts for installing and using the application

To install the Kaspersky Security management MMC plug-ins and the Integration Server, an account that belongs to the group of local administrators on the device where installation is performed must be used.

The following accounts can be used to start the Integration Server Console:

• If the device hosting Kaspersky Security Center Administration Console belongs to the Microsoft Windows domain, you can use an account that belongs to the local or domain KLAdmins group or an account that belongs to the local administrators group to start the Integration Server Console. You can also use the Integration Server administrator account created automatically during the Integration Server installation.
• If the device on which Kaspersky Security Center Administration Console is installed is not a member of a Microsoft Windows domain or your account is not a member of the local or domain KLAdmins group or the local administrators group, you can only use the Integration Server administrator account, that was automatically created when installing the Integration Server, to start the Integration Server Console.

VMware vSphere platform

The following accounts are required for installation and operation of the application on a VMware ESXi hypervisor:

• An administrator account with the following rights is required to deploy, delete, or reconfigure an SVM:
  • Datastore.Allocate space
  • Datastore.Low level file operations
  • Datastore.Remove file
  • Global.Cancel task
  • Global.Licenses
  • Host.Config.Virtual machine autostart configuration
  • Host.Inventory.Modify cluster
  • Network.Assign network
  • Tasks.Create task
  • vApp.Import
  • Virtual machine.Change configuration.Add new disk (only for VMware vCenter Server 7.0 and VMware vCenter Server 6.7)
  • Virtual machine.Configuration.Add new disk (only for VMware vCenter Server 6.5)
  • Virtual machine.Change configuration.Add or remove device (only for VMware vCenter Server 7.0 and VMware vCenter Server 6.7)
  • Virtual machine.Configuration.Add or remove device (only for VMware vCenter Server 7.0 and VMware vCenter Server 6.7)
  • Virtual machine.Change configuration.Change memory (only for VMware vCenter Server 7.0 and VMware vCenter Server 6.7)
  • Virtual machine.Configuration.Memory (only for VMware vCenter Server 6.5)
  • Virtual machine.Interaction.Power Off
  • Virtual machine.Interaction.Power On
  • Virtual machine.Provisioning.Customize guest (only for VMware vCenter Server 7.0 and VMware vCenter Server 6.7)
  • Virtual machine.Provisioning.Customize (only for VMware vCenter Server 6.5)
  • Virtual machine.Inventory.Create new (only for VMware vCenter Server 6.5)
  • Virtual machine.Inventory.Remove (only for VMware vCenter Server 6.5)
• To connect the Integration Server to the VMware vCenter Server, it is recommended to use an account that has been assigned the preset system role ReadOnly.
• Connection of the Integration Server to VMware NSX Manager requires a VMware NSX Manager account that has been assigned the Enterprise Administrator role.

Roles should be assigned to accounts at the top level of the hierarchy of VMware inventory objects, that is, at the level of VMware vCenter Server.

Microsoft Hyper-V platform

To deploy, delete, or reconfigure an SVM on a Microsoft Windows Server (Hyper-V) hypervisor, a built-in local administrator account or domain account that belongs to the Hyper-V Administrators group is required. For a domain account, you must also grant permissions for remote connection and use of the following WMI namespaces:

• root\cimv2
• root\MSCluster
• root\virtualization
• root\virtualization\v2 (for versions of Microsoft Windows server operating systems, beginning with Windows Server 2012 R2)

A built-in local administrator account or domain account that belongs to the Hyper-V Administrators group and has the permissions listed above is also used to connect the Integration Server to a Microsoft Windows Server (Hyper-V) hypervisor.

Citrix Hypervisor platform

The following accounts are required for installation and operation of the application on Citrix Hypervisor:

• To deploy, remove, or reconfigure an SVM, an account with Pool Admin rights is required.
• To connect the Integration Server to the Citrix Hypervisor, it is recommended to use an account with the Read Only role.

KVM platform

The following accounts are required for installation and operation of the application on a KVM hypervisor:

• To deploy, delete, or reconfigure an SVM, a root account, or an account with the right to perform actions on behalf of the root account, is required.
• To connect the Integration Server to the KVM hypervisor, it is recommended to use an unprivileged user account with access to the "read only" Unix socket (libvirt-sock-ro) of the libvirtd service (libvirtd daemon).

Proxmox VE platform

The following accounts are required for installation and operation of the application on a Proxmox VE hypervisor:

• To deploy, remove, or reconfigure an SVM, the root account is required.
• To connect the Integration Server to the Proxmox VE hypervisor, it is recommended to use an account that has been granted access with the PVEAuditor role to the root directory (/) and all child directories.

Skala-R platform

The following accounts are required for installation and operation of the application on a R-Virtualization hypervisor:

• To deploy, remove, or reconfigure an SVM, an account with the "Main Administrator" role is required.
• To connect the Integration Server to the Skala-R Management virtual infrastructure administration server, it is recommended to use an account with the "Infrastructure Monitoring" role.

HUAWEI FusionSphere platform

The following accounts are required for installation and operation of the application on a HUAWEI FusionCompute CNA hypervisor:

• To deploy, remove, or reconfigure an SVM, an account with the VMManager role is required.
• To connect the Integration Server to a HUAWEI FusionCompute VRM, it is recommended to use an account with the Auditor role.

Nutanix Acropolis platform

The following accounts are required for installation and operation of the application on a Nutanix AHV hypervisor:

• To deploy, remove, or reconfigure an SVM, an account with Cluster Admin role is required.
• To connect the Integration Server to Nutanix Prism virtual infrastructure administration server, it is recommended to use an account with the Viewer role. In the infrastructure managed by Nutanix Prism Central, an account with the Viewer role is required on the Nutanix Prism Central server and on the Nutanix Prism Element servers.

TIONIX Cloud Platform and OpenStack platform

The following accounts are required for installation and operation of the application on a KVM hypervisor running on TIONIX Cloud Platform or the OpenStack platform:

• An account with the following permissions is required to deploy, delete, or reconfigure an SVM:

  Permissions for infrastructure object operations.	Permissions for sending requests to OpenStack microservices API
  Keystone
  Authentication. Querying the state of authentication token for the current user.	auth/tokens (POST/GET)
  Getting a list of all OpenStack domains.	domains (GET)
  Getting a list of available OpenStack projects for the current user.	auth/projects (GET)
  Compute (Nova)
  Getting a list of virtual machines.	servers/detail (GET)
  Getting virtual machine information.	servers/{server_id} (GET)
  Getting a list of virtual machine types (instance types).	flavors/detail (GET)
  Getting information about available OpenStack project resources.	limits (GET)
  Getting a list of server groups.	os-server-groups (GET)
  Getting a list of availability zones.	os-availability-zone (GET)
  Getting a list of network interface of the virtual machine.	servers/{server_id}/os-interface (GET)
  Creating a network interface for the virtual machine.	servers/{server_id}/os-interface (POST)
  Creating the virtual machine.	servers (POST)
  Starting/stopping the virtual machine.	servers/{server_id}/action (POST)
  Removing network interface of the virtual machine.	servers/{server_id}/os-interface/{port_id} (DELETE)
  Removing the virtual machine.	servers/{server_id} (DELETE)
  Cinder
  Getting a list of volume types.	{project_id}/types (GET)
  Getting disk information.	{project_id}/volumes/{volume_id} (GET)
  Creating the disk.	{project_id}/volumes (POST)
  Removing the disk that was created by the current user.	{project_id}/volumes/{volume_id} (DELETE)
  Glance
  Getting image information.	images/{image_id} (GET)
  Creating the image.	images (POST)
  Downloading the image.	images/{image_id}/file (PUT)
  Removing the image that was created by the current user.	images/{image_id} (DELETE)
  Neutron
  Getting a list of networks.	networks (GET)
  Getting a list of security groups.	security-groups (GET)
  Creating a network port	ports (POST)
  Deleting a network port	ports/{port_id} (DELETE)
  Getting the ID of a network port	ports/{port_id} (GET)

• An account with the following permissions is required to connect the Integration Server to the virtual infrastructure:

  Permissions for infrastructure object operations.	Permissions for sending requests to OpenStack microservices API
  Keystone
  Authentication. Querying the state of authentication token for the current user.	auth/tokens (POST/GET)
  Getting a list of available OpenStack projects for the current user.	auth/projects (GET)
  Compute (Nova)
  Getting a list of virtual machines.	servers/detail (GET)
  Getting virtual machine information.	servers/{server_id} (GET)
  Getting a list of server groups.	os-server-groups (GET)
  Getting a list of availability zones.	os-availability-zone (GET)
  Getting a list of hypervisors. This permission is required only if you intend to apply licensing scheme that uses number of processors or number of processor cores on hypervisors, on which the protected virtual machines operate.	/os-hypervisors/detail (GET)

ALT Virtualization Server platform

The following accounts are required for installation and operation of the application on a basic hypervisor of the ALT Virtualization Server platform:

• To deploy, delete, or reconfigure an SVM, a root account, or an account with the right to perform actions on behalf of the root account, is required.
• To connect the Integration Server to a basic hypervisor of the ALT Virtualization Server platform, it is recommended to use an unprivileged user account with access to the "read-only" Unix socket (libvirt-sock-ro) of the libvirtd service (libvirtd daemon).

Astra Linux Platform

The following accounts are required for installation and operation of the application on a KVM hypervisor running on the Astra Linux platform:

• To deploy, delete, or reconfigure an SVM, a root account, or an account with the right to perform actions on behalf of the root account, is required.

  Prior to starting installation of the application, you need to configure the user account that will be used for SVM deployment, removal and reconfiguration.

• To connect the Integration Server to a KVM hypervisor running on the Astra Linux platform, it is recommended to use an unprivileged user account with access to the read-only Unix socket (libvirt-sock-ro) of the libvirtd service (libvirtd daemon).