topic Permission Denied whilst entering cplic or any cp command in Firewall and Security Management

Permission Denied whilst entering cplic or any cp command

Duffy — Tue, 15 Aug 2023 12:39:29 GMT

Hello,

I am having issues in applying the cp commands as it gives me permission denied as follows:

Last login: Tue Aug 15 13:56:27 2023 from 10.21.0.254
-bash: /etc/hcp/conf/.new_hcp_take_installed: Permission denied

rm: cannot remove '/etc/hcp/conf/.new_hcp_take_installed': Permission denied
-bash: /bin/fwaccel_autocomplete.sh: No such file or directory
[Expert@Mgmt]# cphaprob stat
-bash: cphaprob: command not found
[Expert@Mgmt]# cplic print
-bash: cplic: command not found
[Expert@Mgmt]# clish
CLINFR0771 Config lock is owned by ca_ocd_ladmin. Use the command 'lock database override' to acquire the lock.
Mgmt> cpprob stat
CLINFR0329 Invalid command:'cpprob stat'.
Mgmt> cplic print
/tmp/.CPprofile.sh: line 1: /opt/CPshrd-R81.10/scripts/cpprofile_functions.sh: Permission denied
Mgmt>

the user account that i use is the same as the user account of admin with shell : /etc/cli.sh , i tried with the another shell with /bin/bash but in vain too.

There is no authentication raduis configued just accounts to access the WebUI of the firewall. Any ideas ?

Thank you

Re: Permission Denied whilst entering cplic or any cp command

_Val_ — Tue, 15 Aug 2023 13:51:15 GMT

Do you have other admin accounts where this works?

Re: Permission Denied whilst entering cplic or any cp command

Duffy — Tue, 15 Aug 2023 15:10:27 GMT

Hello Val,

Yes the default admin account , i just noticed that i changed the account i am using to the same uid for the default admin account and it worked afterwards.

Seems a strange way to make it work , but it worked in the end.

Thank you.

Re: Permission Denied whilst entering cplic or any cp command

_Val_ — Tue, 15 Aug 2023 16:25:12 GMT

This is not a fix. Something was misconfigured with your non-working account, and now you do not know what exactly. Check the user role it was created with.

Re: Permission Denied whilst entering cplic or any cp command

the_rock — Tue, 15 Aug 2023 18:08:44 GMT

As Val said, something efinitely would have been misconfigured with the other account. If default admin account works fine, then its either permission issue or UID.

Andy

Its like below:

Re: Permission Denied whilst entering cplic or any cp command

Duffy — Thu, 17 Aug 2023 04:56:19 GMT

Turns out the uid in the end when i changed it to 0 instead of 104 uid assigned earlier it worked fine afterwards.

Re: Permission Denied whilst entering cplic or any cp command

Duffy — Thu, 17 Aug 2023 04:57:40 GMT

the user role that it's assigned too is the same as admin and i thought of changing the uid back to 0 same as admin account , this is where it started working as intended.

Re: Permission Denied whilst entering cplic or any cp command

SunilShivnani1 — Wed, 26 Jun 2024 18:18:55 GMT

I am facing same issue with some of the gateways. I login with my ID which is Non-Gaia (non_local) user ID using TACACS authentication. Then elevate privilege to TACP-15 and jump to Expert. As the user doesn't exist in GAIA configuration, I can't set UID 0. This issue is only on few gateways, while in large number of other gateways, it works fine. I am sure there is no difference in configuration of all these gateways.

I welcome any suggestions.

Re: Permission Denied whilst entering cplic or any cp command

MSpA — Tue, 27 Aug 2024 07:11:06 GMT

Hi,

I have the same behavior with RADIUS users.

I tried to set "Super User UID" parameter to "0" but still have the problem.

Any idea?

Super User UID

expert message

Re: Permission Denied whilst entering cplic or any cp command

_Val_ — Tue, 27 Aug 2024 07:16:57 GMT

Please look into sk120972

Re: Permission Denied whilst entering cplic or any cp command

MSpA — Tue, 24 Sep 2024 10:07:03 GMT

Hello Valery,

thank you for your help. We finally configured the given sk120972 which solved the problem. I can also confirm that it works with both /etc/cli.sh and /bin/bash shells.

We used Cisco ISE in order to pass the 2 parameters: CP-Gaia-User-Role and CP-Gaia-SuperUser-Access.

Any experience with Okta? It seems like it cannot pass more than 1 parameter.