Description
In firmware version 5.4, read-only administrators can no longer create configuration backups or restore configurations via the GUI.
Read-only administrators can still create backups via CLI with some restrictions.
Solution
The following information will not be contained when a read-only administrator creates a backup via CLI (#execute backup):
- Super_admin settings.
- Administrator profiles with more privileges than the read-only admin.
- If the admin is restricted to a VDOM, any settings in other VDOMs.
Read-only administrators can only see limited information about administrator profiles using #show system admin; Password hashes and some other settings will not be visible.
For full configuration backups, an administrator with full read-write access is required.
These changes were implemented so that read-only administrators could not gain access to information that only full administrators should see (for example: PW hashes for full administrators) or be able to modify and restore configurations to gain elevated access privileges.
