topic Re: Limited Permission Profile in Firewall and Security Management

Limited Permission Profile

Julie_Paul — Tue, 12 Feb 2019 16:39:39 GMT

Can I setup a read only user with a profile that only allows him to read logs and view his policy only? This is on a SMS not an MDM. The purpose is to allow a limited admin the ability to be restricted to just what they control or have a business need to see. They do not see all the policies or logs, just their own at their remote location.

Re: Limited Permission Profile

Alisson_Lima — Tue, 12 Feb 2019 22:27:58 GMT

Hello Julie,

What's the version do you use? On R80.x you can create a specific profile (SmartConsole > Manage & Settings > Permissions & Administrators > Permission profiles) according to you need and associate with the user, but we can't create a profile read/write for a specific gateway or policy package.

For more details, please see: SmartConsole R80 Help .

Alisson Lima

Re: Limited Permission Profile

Julie_Paul — Tue, 12 Feb 2019 22:54:49 GMT

R80.20 That is the problem. I have customers who need the ability to create limited view admin profiles. They are too small to be an MDM shop but still need the flexibility to only allow specific users read access to specific policies and the logs associated to that policy.

Re: Limited Permission Profile

Vladimir — Wed, 13 Feb 2019 05:52:11 GMT

You can grant them access to logs in unfiltered but read only mode via smartview:

https://management_ip/smartview

by restricting their access to the management server to https only:

Re: Limited Permission Profile

Julie_Paul — Wed, 13 Feb 2019 13:28:47 GMT

That will not work, they need to only see their gateway logs and the policy also.

Re: Limited Permission Profile

PhoneBoy — Sat, 16 Feb 2019 00:42:53 GMT

Since you also asked this question internally and got an answer, why not propagate the answer here

In general, you can restrict the logs a given user sees in SmartView.

You cannot currently restrict read access to all policies in SmartConsole.

In order to apply a “hardcoded” filter which the user will not be able to edit (in order to restrict the ability to see logs not relevant), perform the following steps.

Edit a file called users.xml which exists under $RTDIR/smartview/db/domains/XXXXX
If you have several domains you can look at the file domain.txt under each domain folder in order to know the name of the domain
In the users.xml file you’ll see <user> tags
You can add a filter tag to the corresponding user tags which will be added to every query the user will send.
An Example of a filter which will display only Application Control logs of a specific user:

<filter>
    <and>
        <equals>
            <field><![CDATA[product]]></field>
            <value><![CDATA[Application Control]]></value>
        </equals>
        <equals>
            <field><![CDATA[user]]></field>
            <value><![CDATA[John Smith]]></value>
        </equals>
    </and>
</filter>

Restart SmartView by running the commands:
$RTDIR/scripts/stopSmartView
$RTDIR/scripts/startSmartView

Re: Limited Permission Profile

Aitor_Carazo — Wed, 06 Mar 2019 15:18:47 GMT

Hi,

I have tried to perform this changes on one user and when i tried to connect via web Smartview i get an error after log-in

Initialization failed

error ref id:6380036B

I also have tried with the exact example of APPCTL and Jhon Smith and also fails

   ........................ 
   <tabs>
       <active><![CDATA[{769F9EF8-606A-4956-A357-675E311C632A}]]></active>
       <uid><![CDATA[{769F9EF8-606A-4956-A357-675E311C632A}]]></uid>
    </tabs>
    <emailServer/>
    <_timestamp_><![CDATA[2019-03-06T15:36:12+01:00]]></_timestamp_>
    <filter>
       <field><![CDATA[origin]]></field>
       <value><![CDATA[BranchFW]]></value>
    </filter>
    </user>
</users>

I tried to find the syntax but there is no info.

How could i get this working?

Where is the error?

Thank you very much.

Re: Limited Permission Profile

PhoneBoy — Thu, 07 Mar 2019 02:40:17 GMT

Try:

<filter>origin:BranchFW</filter>

Re: Limited Permission Profile

Aitor_Carazo — Fri, 08 Mar 2019 09:31:51 GMT

Re: Limited Permission Profile

PhoneBoy — Fri, 08 Mar 2019 15:03:15 GMT

I assume that worked, then?

Re: Limited Permission Profile

Aitor_Carazo — Wed, 20 Mar 2019 10:20:54 GMT

It Works Perfectly!!!

Re: Limited Permission Profile

steve_warren — Wed, 11 Dec 2019 01:14:10 GMT

I have been searching for this solution months now.

I would love a sample config of the users.xml file to restrict a user to only be able to view logs generated from a specific gateway.

Re: Limited Permission Profile

Dror_Aharony — Sun, 15 Dec 2019 14:49:40 GMT

Insert the filter line to the right users.xml file like this:

in $RTDIR/smartview/db/domains/<relevant_domain_id>/users.xml

Restart Smartview:

$RTDIR/scripts/stopSmartView; $RTDIR/scripts/startSmartView

Re: Limited Permission Profile

AntonMakarychev — Mon, 27 Jan 2020 10:35:19 GMT

And if I need to add more than one gateway for the user?

Re: Limited Permission Profile

Dror_Aharony — Mon, 27 Jan 2020 10:38:44 GMT

Simply add an OR.

<filter><![CDATA[orig:<GW_Name/IP> OR orig:<GW2>]]></filter>

Re: Limited Permission Profile

AntonMakarychev — Mon, 27 Jan 2020 10:45:17 GMT

Thank you!

Re: Limited Permission Profile

Hrvoje_Brlek — Wed, 19 Feb 2020 08:35:24 GMT

Hi, I am also trying to limit the visible data to the user. The filter <filter><![CDATA[orig:<GW_Name/IP>]]></filter> works fine, but I have a different kind of problem.

We are using MDS, and when the user connects to SmartViev he can choose between the global domain (MDS) and a specific domain. If he chooses the specific domain the filter works fine. If he chooses the global domain (MDS) the filter does not apply, he can see all the logs 😐

Can I restrict the user access not to be able to connect to the global domain (MDS) thorugh SmartView at all, or to filter the view on MDS?
In the SmartConsole on the MDS I have restricted the user permission to view the logs only and to be able to see only one domain (the other domains aren't visible), but the option of viewing logs on the global domain (MDS) is always available through SmartView.

Thanks!

Re: Limited Permission Profile

Amir_Senn — Wed, 19 Feb 2020 08:57:52 GMT

You can try either of the following:

1, You can remove the global domain from his administrator all together from and he won't be able to connect to MDS level at all.

2. You can assign him a permission profile to the global domain that doesn't have log permission. Go to Permission profile -> Monitoring and Logging and remove the permission for traffic logs and management logs.

3. You can change the admin type to a "Domain Level Only". This kind of profile can't connect to global level.

Re: Limited Permission Profile

Hrvoje_Brlek — Wed, 19 Feb 2020 10:16:55 GMT

Hi, I am testing and this is what I get. Just to clarify I am talking about SmartView browser viewing, not the SmartConsole access. The user is local, and we are using R80.30.

3. It was already configured as domain-level only, but can still connect to MDS on SmartView (with all logs visible).

2. The multi-domain permission is obligatory on the user profile. This is how it was set, and it doesn't work. Still all the logs are visible through MDS on SMartView.

Multi-domain:

Read-only NO access:

Read only Log:

User profile:

1. Can you please elaborate this one, or how to set it up?

Re: Limited Permission Profile

Amir_Senn — Wed, 19 Feb 2020 12:26:50 GMT

1. On the last picture you added, there's a "All Global Domains" item on the domains list. The intention was to remove it by selecting it and clicking on the X above.

I want to elaborate on something, at least from logs perspective. Everything you see on SmartConsole should be identical to what you see on the SmartView webapp. There should be no difference whatsoever. If there is a difference there's an issue here.

First thing I suggest you should do is to check if you have some sort of access roles. Perhaps it signs in with an access role and not the CP admin you created for him.

If it's not related then this is an issue. I would suggest installing latest jumbo hotfix to see if this solves this.

If the issue continues, I suggest opening ticket for TAC support.