Configuring Roles in Gaia Clish

You can:

  • Add, change, or delete roles.

  • Add or remove users to or from existing roles.

  • Add or remove access mechanism permissions for a specified user.

Important - On Scalable Platforms (Maestro and Chassis), you must run the applicable commands in GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. gClish of the applicable Security Group.

Syntax

add rba role <New Role Name> domain-type System
      all-features
      readonly-features <List of RO Features>
      readwrite-features <List of RW Features>}

Note - You can add "readonly-features" and "readwrite-features" in the same command.

 
add rba role <Existing Role Name>
      virtual-system-access 0
      virtual-system-access all
      virtual-system-access VSID1,VSID2,...,VSIDn
 
add rba user <User Name>
      access-mechanisms Web-UI
      access-mechanisms CLI
      access-mechanisms Web-UI,CLI
      access-mechanisms Gaia-API

add rba user <User Name> roles <Role1,Role2,...,RoleN> 

show rba
      all
      role <Role Name>
      roles
      user <User Name>
      users

delete rba role <Role Name> 

delete rba role <Role Name>
      readonly-features <List of RO Features>
      readwrite-features <List of RW Features>

Note - You can delete "readonly-features" and "readwrite-features" in the same command.

 
delete rba user <User Name>
      access-mechanisms Web-UI
      access-mechanisms CLI
      access-mechanisms Web-UI,CLI
      access-mechanisms Gaia-API

delete rba user <User Name> roles <Role1,Role2,...,RoleN>

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently.

Notes:

  • There are no "set" commands for configured roles.

  • You cannot delete the default roles adminRole or monitorRole.

Parameters

Parameter

Description

role <Role Name>

Role name as a character string that contains letters, numbers or the underscore (_) character.

The role name must start with a letter.

domain-type System

Reserved for future use.

virtual-system-access {0 | all | VSID1, VSID2, ..., VSIDn}

Specifies which VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Virtual Systems this role can access:

all-features

Grants read-write permissions to all features.

Important - This is equivalent to the admin role!

readonly-features <List of RO Features>

A comma-separated list of Gaia features that have read-only permissions in the specified role.

See:

Notes:

  • Press <SPACE><TAB> to see the list of available features.

  • You can add read-only and read-write feature lists in the same "add rba role <Role Name> domain-type System ..." command.

readwrite-features <List of RW Features>

A comma-separated list of Gaia features that have read-write permissions in the specified role.

See:

Notes:

  • Press <SPACE><TAB> to see the list of available features.

  • You can add read-only and read-write feature lists in the same "add rba role <Role Name> domain-type System ..." command.

Important - A user with read/write permission to the user feature can change a user password, including that of the admin user. Be careful when assigning roles that include this permission!

user <User Name>

User, to which access mechanism permissions and roles are assigned.*

roles <Role1,Role2,...,RoleN>

Comma-separated list of role names that are assigned to or removed from the specified user (spaces are not allowed in this syntax).*

access-mechanisms {Web-UI | CLI | Web-UI,CLI | Gaia-API}

Defines the access mechanisms that users can work with to manage Gaia:*

* To configure these settings in Gaia Portal, see Managing User Accounts in Gaia Portal.

gaia> add rba role NewRole domain-type System readonly-features vpn,ospf,rba readwrite-features snmp
 
gaia> show rba role NewRole
Role
    NewRole
    domain-type System
    read-write-feature snmp
    read-only-feature vpn,ospf,rba
gaia>
 
gaia> add rba user John roles NewRole
 
gaia> add rba user John access-mechanisms Web-UI,CLI
 
gaia> show rba user John
User
    John
    access-mechanism CLI
    access-mechanism Web-UI
    role NewRole
gaia>
 
gaia> delete rba user John roles NewRole
 
gaia> delete rba role NewRole