Restricting Admin Access and Configuring Read-Only Mode in Smarts Console

Products

• VMware Telco Cloud Service Assurance

Issue/Introduction

Customers or internal security auditors may require access restrictions to be implemented in the Smarts environment, specifically:

• Restricting the default "admin" account from having full write access.
• Creating new user accounts with read-only permissions for auditing purposes.
• Ensuring LDAP/System-authenticated users default to a "Monitor" (read-only) role.

Environment

DX NetOps Smarts 24.x, 25.x

Cause

By default, the "admin" user entry in serverConnect.conf is often set to the All permission level. To satisfy "Least Privilege" security requirements, this must be manually restricted to the Monitor level.

Resolution

1. Modify User Permissions via serverConnect.conf

All user access and permission levels are managed within the serverConnect.conf file.

1. Navigate to the /bin directory of your Smarts installation.
2. Open the configuration file using the mandatory sm_edit utility:
   bash

    

   ./sm_edit conf/serverConnect.conf

   Note: Using any other text editor (like vi or notepad) will corrupt the encryption and prevent all users from logging in.
3. Locate the user access section. To change the admin account to read-only, modify the entry: From: *:admin:<encrypted_password>:All To: *:admin:<encrypted_password>:Monitor
4. To add a new read-only auditor account, add a new line: *:auditor_name:password:Monitor
5. Save and close the file. sm_edit will automatically encrypt the new plain-text password.

2. Configure Smarts SAM Global Manager (If applicable)

For Service Assurance Manager (SAM) environments, the user must also exist in the SAM repository.

1. Log into the Smarts SAM console with administrative credentials.
2. Navigate to Configure > Global Manager Administration Console.
3. Right-click Users and select New User (or use the User Wizard).
4. Enter the exact username created in Step 1.
5. Associate the user with a Profile that limits privileges (e.g., a "Monitor" or "Operator" profile that lacks administrative permissions).
6. Click Finish. Changes take effect immediately; no restart is required.

3. Permission Level Definitions

• All: Full administrative access (read/write).
• Monitor: Read-only access to notifications and topology.
• Ping: Extremely limited access; primarily for connectivity testing.
• None: No access allowed.