Security Manager

Configure and manage security-related settings.

Set security and access options.

In QuantaStor, the "Security Manager" is a feature that allows administrators to configure and manage security-related settings and features within the storage environment. The Security Manager provides a centralized interface for managing various security aspects of the QuantaStor storage system. The purpose of the Security Manager in QuantaStor includes:

• Authentication and Access Control: The Security Manager enables administrators to configure authentication methods and access control policies for user access to the QuantaStor storage system. This includes settings such as password policies, account lockout rules, and authentication protocols to ensure secure access.
• Encryption: The Security Manager allows administrators to configure encryption settings for data at rest and in transit within the QuantaStor storage system. This includes options for enabling encryption on storage volumes, shares, or file systems, as well as configuring encryption protocols and algorithms.
• Role-Based Access Control (RBAC): QuantaStor supports RBAC, and the Security Manager provides tools for creating and managing user roles and associated access privileges. Administrators can define custom roles or assign users to predefined roles, ensuring fine-grained access control based on user responsibilities.
• Security Auditing: The Security Manager facilitates security auditing by providing configuration options for logging and monitoring user activities within the QuantaStor system. Administrators can enable auditing features, specify log levels, and configure log destinations to track and review system events for security analysis and compliance purposes.
• Integration with Directory Services: The Security Manager allows administrators to integrate QuantaStor with external directory services, such as Active Directory or LDAP. This integration enables centralized user authentication and management, simplifying user provisioning, authentication, and access control.
• Secure Remote Management: QuantaStor provides secure remote management capabilities, and the Security Manager enables administrators to configure and manage secure remote access settings. This includes options for enabling secure protocols, such as SSH or HTTPS, and configuring access control for remote management interfaces.
• Firewall and Network Security: The Security Manager allows administrators to configure firewall settings and network security features within the QuantaStor system. This includes setting up firewall rules, managing IP address whitelists or blacklists, and defining network access control policies to protect the storage system from unauthorized access.

Overall, the purpose of the Security Manager in QuantaStor is to provide administrators with a centralized interface to configure and manage various security-related settings and features. It encompasses authentication and access control, encryption, RBAC, security auditing, integration with directory services, secure remote management, firewall and network security settings, ensuring the overall security and protection of the QuantaStor storage system and its data.

Single Sign-On (SSO)

This section covers enabling and configuring Single Sign-On for the QuantaStor Web Interface, including Active Directory group mapping and secure LDAPS implementation.

Enabling Single Sign-On

1. Navigate to Security → Management Users → User → Security Manager (toolbar) → Advanced Settings.
2. Check the Enable Single Sign-On box.
3. Enter the LDAP Server (FQDN): dc.yourdomain.com
4. Set the LDAP Server Base DN for Users: dc=yourdomain,dc=com

Mapping Active Directory Groups to Roles

QuantaStor determines access permissions based on Active Directory group membership. There are two methods to map AD groups to QuantaStor roles.

Method 1: Automatic Naming Pattern

Create AD groups using the naming pattern QS- followed by the role name. QuantaStor will detect these automatically.

QuantaStor Role	Active Directory Group
Administrator	QS-Administrator
Object Tenant Admin	QS-Object Tenant Admin
System Monitor	QS-System Monitor

Method 2: Manual Role Assignment

The Modify Role dialog showing the LDAP Group field mapped to an existing AD group.

To map existing AD groups without renaming them:

1. Navigate to Security → Management Users → Role → Modify (toolbar).
2. Enter your existing AD group name into the role's LDAP Group field.

Implementing Secure Authentication (LDAPS)

To secure LDAP authentication with TLS:

1. On the Domain Controller: Install and trust an LDAPS certificate. The certificate must list the DC's full FQDN (e.g., dc.yourdomain.com). If it does not, the connection will fall back to unsecured LDAP.
2. On each QuantaStor node: Upload the certificate to the node, then edit /etc/ldap/ldap.conf and ensure the following lines are present:

TLS_CACERT   /path/to/certificate.crt
TLS_REQCERT  demand

Restart the SSO daemon so it picks up the change:

systemctl restart qs-sso-authd

Login Format

When logging into the Web UI, always use DOMAIN\username format. Do not use UPN format (username@domain.com), as the system may misinterpret the suffix as a server address.

Verifying SSO and LDAPS

Check the SSO log to confirm TLS is active and authentication is succeeding:

/var/log/qs/qs-sso-authd.log

Expected output when LDAPS is working correctly:

{Wed Jun 17 08:00:26 2026, INFO} TLS or SSL already in effect
{Wed Jun 17 08:00:26 2026, INFO} Attempting to bind 'alex@DOMAIN'
{Wed Jun 17 08:00:26 2026, INFO} Bind using 'alex@DOMAIN' was successful
{Wed Jun 17 08:00:26 2026, INFO} user group = CN=IT,CN=Users,DC=domain,DC=net

Navigation: Security --> Management Users --> User --> Security Manager (toolbar)







Return to the QuantaStor Web Admin Guide