Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 2380 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos client firewall and local admin rights

barryp

Hi

new user to Sophos endpoint and the console. Am trying to deploy the client firewall 2.5.0 to end users machine but when they are in interactive mode it seems that users without local admin righst can't add applications to the policy or permit access etc? Does anyone know what files or folders I need to give the builtin users group write access to? Have tried searching on here etc but can't seem to find the info?

Thanks in advance.

:6807


This thread was automatically locked due to age.
  • 0

    Hello barryp,

    interactive means that whenever an event is not covered by the existing rules and settings the user is prompted for a "decision". Of course a "limited" user can only create rules for his own account and not system wide.

    What exactly do you mean by can't add applications?

    Christian

    :6843
  • 0

    Christian

    Thanks for the reply. I've more or less sorted this with Sophos support, the Sophos Firewall is different from our last product (McAfee) in that although members of the local users group can create application rules, they can't add checksums for new or ammended applications.

    It's more secure that way of course but a bit harder for us to administrate when we have so many different versions of so much different software out in the field.

    :6899
  • 0

    I'm revisiting this thread because with our recent test upgrade to 9.7, I find that regular users are not able to 'allow all' for applications any more, they can only 'allow once'. Does anyone know if this is by design or do I have a configuration problem? I can sort of understand it, but it is a real pain. I obviously won't make users admin on their boxes, don't even want to make them Power Users, but would consider that if it fixed the problem. Thoughts?

    And... if it is by design, why are users offered the option? An example follows:

    Coffee Cup HTML Editor (coffee.exe) - used by one user, it is not configured by SEC. It access website via FTP, using standard port 21 call then passive port call. The Sophos dialog pops up, if I say allow all, it hangs for 60 seconds and times out. In the Sophos log it shows as 'Blocked, Reason: Interactive Mode' or something like that. If I allow once, it works, pops up again, and I have to allow once again. And I have to do this every time I want to do anything with the site. It seems to me that if it's by design, the option should be greyed or a big popup should say 'Talk to your admin about approving this!'

    :13479