topic Re: Permissions issues after migrating to Unprivileged mode-How are we supposed to run unprivileged but complete admin t in Splunk SOAR

Permissions issues after migrating to Unprivileged mode-How are we supposed to run unprivileged but complete admin tasks

kbuckle7 — Tue, 29 Nov 2022 15:30:01 GMT

After updating to unprivileged mode (because privileged is being depcrecated), we are getting access denied issues when running some commands. For example: "phenv ibackup --setup"

So far, the issues seem to be with commands that relate to Postgres.

How are we supposed to run unprivileged, but complete admin tasks?

Note: If I run the commands as root, I get this error: "CommandError: This command must be executed by user phantom."

Thanks!

Re: Permissions issues after migrating to Unprivileged mode

phanTom — Tue, 29 Nov 2022 15:30:44 GMT

@kbuckle7 sorry to hear you are having issuespost-conversion!

Have you engaged support yet??

What version are you? How did you convert? Did you use the migrate.py and it returned no issues/warnings?

Do all your directories under $PHANTOM_HOME now appear to be owned by Phantom?

If you have a support entitlement I would highly recommend raising this as a P2.

Re: Permissions issues after migrating to Unprivileged mode

kbuckle7 — Tue, 29 Nov 2022 15:41:26 GMT

Thanks for the quick reply!

We are on version 5.3.3 and ran the migrate.py script.

All directories in /opt/phantom are owned by phantom:phantom

I was hoping the community had seen this before opening a support ticket.

Re: Permissions issues after migrating to Unprivileged mode-How are we supposed to run unprivileged but complete admin t

phanTom — Tue, 29 Nov 2022 15:52:29 GMT

I have not seen this but I have also asked in the #SOAR community Slack channel.

I highly recommend signing up if not already: https://docs.splunk.com/Documentation/Community/current/community/Chat

Re: Permissions issues after migrating to Unprivileged mode

kbuckle7 — Tue, 29 Nov 2022 16:06:03 GMT

Thanks! I joined...