topic Re: Monitor user / read user with permissions to execute troubleshooting commands in General Topics

Monitor user / read user with permissions to execute troubleshooting commands

intaq — Wed, 12 Feb 2025 15:25:08 GMT

Hello:

I am trying to create a user with monitoring permissions and also that can execute troubleshooting commands:

tcpdump
fw monitor
cpview
etc

For this I have created a role clone of the monitor and I have also allowed expert mode and the commands but it does not allow SSH access, for it to work I have to give it also adminRole roles.

Do you know what I could be missing?

Thanks!!

Re: Monitor user / read user with permissions to execute troubleshooting commands

Lesley — Wed, 12 Feb 2025 17:44:34 GMT

Here are the supported commands you can use in a role:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG/Roles-Extended-Commands.htm?tocpath=User%20Management%7CRoles%7C_____4

Second you need to create an admin role instead if monitor role. Monitor role is read-only. Admin role you give view access and write access.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG/Roles.htm?tocpath=User%20Management%7CRoles%7C_____0

Re: Monitor user / read user with permissions to execute troubleshooting commands

intaq — Thu, 13 Feb 2025 08:43:47 GMT

Hello!

Thanks for your reply!

The idea is to create a read-only user with troubleshooting capabilities. That is why we clone the Role from MonitorRole and not from adminRole.