Restricting BigFix Fixlet Usage with Additional Authentication

Content Authoring
1

Hello Folks,

I'm currently working on cleanup Fixlets for a few applications and would like to restrict their usage by other users. Is there a way to add a password protection mechanism to a Fixlet so that only a specific team can execute it?

However, I have a couple of requirements:

  • The password should not be visible within the Fixlet content.

  • The password should not be exposed to users while taking the action.

  • The password should be used only for authorization purposes and should not have any dependency on, or be referenced by, the underlying action script itself.

  • Only authorized team members should be able to execute the Fixlet successfully.

Additionally, the password requirement is intended purely as an authorization mechanism. It does not need to be related to the Fixlet action script, nor should it be passed to or consumed by the script during execution.

I understand this may sound like an unusual requirement, but those of you who work in large-scale environments can probably relate. When many users have console access, there is always a risk of actions being executed unintentionally or by unauthorized personnel.

I'm looking for a way to add an extra layer of control to prevent misuse of these cleanup Fixlets. If implementing password-based access is not possible, I'm open to alternative solutions or best practices that can help achieve similar access restrictions.

Any suggestions would be greatly appreciated.

2

Any reason not to place the Fixlet in a custom site that you permission to only the pertinent BigFix operators?

3 Likes
3

Easiest way which I can think of here is to create a new custom sites and give access to only the required operators. Rest of the operators will not have visibility. And content can be created in custom site

We have implemented similar solution for crowdstrike so that only infosec persons has the access to crowdstrike content. No other operator will have the visibility

1 Like
4

I agree with @Aram and @ersaumitra10 . We do this with dozens of fixlets, tasks and analysis.

Users can be in more than one role so that allows them the current access they have plus a new role you add to allow access to these sensitive tasks/fixlets

1 Like
5

You can use the four eye authentication.