Example SSH filter profiles example

To configure an SSH filter profile that only allows show command on the target server (FortiGate or Cisco routers):

1. Go to Secret Settings > SSH Filter Profiles.
2. In SSH Filter Profiles, select Create.

   The New SSH Filter Profile window opens.

3. Enter a name for the SSH filter profile. In this example, the SSH filter profile is named show only.
4. In Mode, select Allow.
5. Leave Show Allowed List Command in the default state, i.e., menu.
6. Enable Shortcut To Run Listed Commands.
7. Enable Log All Unlisted Commands.
8. Add a pattern:
   1. In the Pattern field, select RegEx, and enter show.*.
   2. Select Add Pattern.
   3. Click the pen icon to edit the pattern, and:
      1. Enable Log.
      2. Enable Email Alert.
      3. Set Severity to Medium.
      4. Select the green check mark.
9. Click Submit.

   

To configure an SSH filter profile that blocks rm and sudo commands on the target Linux server:

1. Go to Secret Settings > SSH Filter Profiles.
2. In SSH Filter Profiles, select Create.

   The New SSH Filter Profile window opens.

3. Enter a name for the SSH filter profile. In this example, the SSH filter profile is named block rm+sudo.
4. Enable Log All Unlisted Commands.
5. Add a pattern:
   1. In the Pattern field, select Start with single word, and enter rm.
   2. Select Add Pattern.
6. Add another pattern:
   1. In the Pattern field, select select Start with single word, and enter sudo.
   2. Select Add Pattern.
7. Click the pen icon to edit the patterns, and:
   1. Enable Log.
   2. Enable Email Alert.
   3. Set Severity to Critical.
   4. Select the green check mark.
8. Follow step 7 to edit the other pattern.
9. Click Submit.