Permission Denied errors for dcmctl or Smarts processes after changing admin to read-only

Products

• Network Observability

Issue/Introduction

When attempting to run dcmctl commands or during failover operations in Smarts, the system returns a "Permission denied" error. This occurs after the admin user has been changed to a read-only role (e.g., "Monitor") in the configuration files.

• Running Smarts command-line utilities such as dcmctl or dmctl returns: Login to Domain Manager failed; permission denied.
• Inter-process communication (IPC) between domain managers or failover managers fails with authentication errors.
• Session disconnected alerts appear in SAM logs between the domain manager and global manager.

Environment

• VMware Smart Assurance (Smarts)
• All supported releases

Cause

The admin user account is utilized by backend Smarts processes for essential inter-process communication (IPC). If the global admin user's privileges are restricted to Monitor (read-only) in the serverConnect.conf file, these backend processes lose the authority required to maintain server-to-server sessions, leading to broad permission denied errors across the environment.

Resolution

To restrict end-user access without breaking backend services, you must retain administrative privileges for the internal admin account and create a separate account for restricted tasks.

1. Revert Admin Privileges

Ensure the admin user has All privileges for IPC stability.

1. Log in to the Smarts server as the local Smarts user.
2. Use sm_edit to modify serverConnect.conf:
   bash

    

   ./sm_edit conf/serverConnect.conf

3. Verify or restore the admin entry to allow full access: *:admin:<encrypted_password>:All

2. Create a Restricted Operator Account

Configure a new user for manual CLI commands and console access.

1. Configure the Client: Use sm_edit to add the new user (e.g., opsOperator) to the SAM console's clientConnect.conf file: *:*:opsOperator:<password>
2. Configure the Server: Use sm_edit to add the same user to the domain manager's serverConnect.conf with restricted privileges: *:opsOperator:<password>:Monitor
3. Save and Restart: Save the files. The passwords will be encrypted automatically. Restarting the affected Smarts services may be necessary to clear hung sm_authority processes.