Limited Permission Profile

[Julie_Paul]

Can I setup a read only user with a profile that only allows him to read logs and view his policy only?  This is on a SMS not an MDM.  The purpose is to allow a limited admin the ability to be restricted to just what they control or have a business need to see.  They do not see all the policies or logs, just their own at their remote location.  

[Alisson_Lima]

Hello Julie,

What's the version do you use? On R80.x you can create a specific profile (SmartConsole > Manage & Settings > Permissions & Administrators > Permission profiles) according to you need and associate with the user, but we can't create a profile read/write for a specific gateway or policy package.

For more details, please see: SmartConsole R80 Help .

Alisson Lima

[Julie_Paul]

R80.20 That is the problem.  I have customers who need the ability to create limited view admin profiles.  They are too small to be an MDM shop but still need the flexibility to only allow specific users read access to specific policies and the logs associated to that policy.

[Vladimir]

You can grant them access to logs in unfiltered but read only mode via smartview:

https://management_ip/smartview 

by restricting their access to the management server to https only:

[Julie_Paul]

That will not work, they  need to only see their gateway logs and the policy also.

[PhoneBoy · Accepted solution]

Since you also asked this question internally and got an answer, why not propagate the answer here

In general, you can restrict the logs a given user sees in SmartView.

You cannot currently restrict read access to all policies in SmartConsole.

In order to apply a “hardcoded” filter which the user will not be able to edit (in order to restrict the ability to see logs not relevant), perform the following steps.

• Edit a file called users.xml which exists under $RTDIR/smartview/db/domains/XXXXX
• If you have several domains you can look at the file domain.txt under each domain folder in order to know the name of the domain
• In the users.xml file you’ll see <user> tags
• You can add a filter tag to the corresponding user tags which will be added to every query the user will send.
• An Example of a filter which will display only Application Control logs of a specific user:

<filter>
    <and>
        <equals>
            <field><![CDATA[product]]></field>
            <value><![CDATA[Application Control]]></value>
        </equals>
        <equals>
            <field><![CDATA[user]]></field>
            <value><![CDATA[John Smith]]></value>
        </equals>
    </and>
</filter>

• Restart SmartView by running the commands:
  $RTDIR/scripts/stopSmartView
  $RTDIR/scripts/startSmartView

[Aitor_Carazo]

Hi,

I have tried to perform this changes on one user and when i tried to connect via web Smartview i get an error after log-in

Initialization failed

error ref id:6380036B

I also have tried with the exact example of APPCTL and Jhon Smith and also fails

   ........................ 
   <tabs>
       <active><![CDATA[{769F9EF8-606A-4956-A357-675E311C632A}]]></active>
       <uid><![CDATA[{769F9EF8-606A-4956-A357-675E311C632A}]]></uid>
    </tabs>
    <emailServer/>
    <_timestamp_><![CDATA[2019-03-06T15:36:12+01:00]]></_timestamp_>
    <filter>
       <field><![CDATA[origin]]></field>
       <value><![CDATA[BranchFW]]></value>
    </filter>
    </user>
</users>

I tried to find the syntax but there is no info. 

How could i get this working?

Where is the error?

Thank you very much.

[PhoneBoy]

Try:

<filter>origin:BranchFW</filter>

[Aitor_Carazo]

[PhoneBoy]

I assume that worked, then?

[Aitor_Carazo]

It Works Perfectly!!!

[steve_warren]

I have been searching for this solution months now.

I would love a sample config of the users.xml file to restrict a user to only be able to view logs generated from a specific gateway.

[Dror_Aharony]

Insert the filter line to the right users.xml file like this:

in $RTDIR/smartview/db/domains/<relevant_domain_id>/users.xml

<owner><![CDATA[admin]]></owner>
<isNewlyCreated><![CDATA[true]]></isNewlyCreated>
<username><![CDATA[admin]]></username>
<locale><![CDATA[en-US]]></locale>
<filter><![CDATA[orig:<GW_Name/IP>]]></filter>
<firstDayOfWeek><![CDATA[2]]></firstDayOfWeek>
<theme><![CDATA[default]]></theme>

Restart Smartview:

$RTDIR/scripts/stopSmartView; $RTDIR/scripts/startSmartView

[AntonMakarychev]

And if I need to add more than one gateway for the user?

[Dror_Aharony]

Simply add an OR.

<filter><![CDATA[orig:<GW_Name/IP> OR orig:<GW2>]]></filter>

[AntonMakarychev]

Thank you!

[Hrvoje_Brlek]

Hi, I am also trying to limit the visible data to the user. The filter <filter><![CDATA[orig:<GW_Name/IP>]]></filter> works fine, but I have a different kind of problem.

We are using MDS, and when the user connects to SmartViev he can choose between the global domain (MDS) and a specific domain. If he chooses the specific domain the filter works fine. If he chooses the global domain (MDS) the filter does not apply, he can see all the logs 😐

Can I restrict the user access not to be able to connect to the global domain (MDS) thorugh SmartView at all, or to filter the view on MDS?
In the SmartConsole on the MDS I have restricted the user permission to view the logs only and to be able to see only one domain (the other domains aren't visible), but the option of viewing logs on the global domain (MDS) is always available through SmartView.

Thanks!

[Amir_Senn]

You can try either of the following:

1, You can remove the global domain from his administrator all together from and he won't be able to connect to MDS level at all.

2. You can assign him a permission profile to the global domain that doesn't have log permission. Go to Permission profile -> Monitoring and Logging and remove the permission for traffic logs and management logs.

3. You can change the admin type to a "Domain Level Only". This kind of profile can't connect to global level.

[Hrvoje_Brlek]

Hi, I am testing and this is what I get. Just to clarify I am talking about SmartView browser viewing, not the SmartConsole access. The user is local, and we are using R80.30.

3. It was already configured as domain-level only, but can still connect to MDS on SmartView (with all logs visible). 

2. The multi-domain permission is obligatory on the user profile. This is how it was set, and it doesn't work. Still all the logs are visible through MDS on SMartView.

Multi-domain:

Read-only NO access:

Read only Log:

User profile:

1. Can you please elaborate this one, or how to set it up?

[Amir_Senn]

1. On the last picture you added, there's a "All Global Domains" item on the domains list. The intention was to remove it by selecting it and clicking on the X above.

I want to elaborate on something, at least from logs perspective. Everything you see on SmartConsole should be identical to what you see on the SmartView webapp. There should be no difference whatsoever. If there is a difference there's an issue here.

First thing I suggest you should do is to check if you have some sort of access roles. Perhaps it signs in with an access role and not the CP admin you created for him.

If it's not related then this is an issue. I would suggest installing latest jumbo hotfix to see if this solves this.

If the issue continues, I suggest opening ticket for TAC support.

[JacWev]

Hello, PhoneBoy, 

Is this also possible to use groupmembership ??

We have a group of administrators to view specific firewall's. 

Kind regards, 

Jaco Wevers

Cyberpeak.