diff --git a/api/proto/api.pb.gw.go b/api/proto/api.pb.gw.go index 71c348300db..f26e639d023 100644 --- a/api/proto/api.pb.gw.go +++ b/api/proto/api.pb.gw.go @@ -22,8 +22,8 @@ import ( "google.golang.org/grpc/status" "google.golang.org/protobuf/proto" "google.golang.org/protobuf/types/known/emptypb" - proto_6 "www.velocidex.com/golang/velociraptor/artifacts/proto" - proto_5 "www.velocidex.com/golang/velociraptor/flows/proto" + proto_5 "www.velocidex.com/golang/velociraptor/artifacts/proto" + proto_2 "www.velocidex.com/golang/velociraptor/flows/proto" ) // Suppress "imported and not used" errors @@ -1293,7 +1293,7 @@ func local_request_API_GetTable_0(ctx context.Context, marshaler runtime.Marshal } func request_API_CollectArtifact_0(ctx context.Context, marshaler runtime.Marshaler, client APIClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_5.ArtifactCollectorArgs + var protoReq proto_2.ArtifactCollectorArgs var metadata runtime.ServerMetadata newReader, berr := utilities.IOReaderFactory(req.Body) @@ -1310,7 +1310,7 @@ func request_API_CollectArtifact_0(ctx context.Context, marshaler runtime.Marsha } func local_request_API_CollectArtifact_0(ctx context.Context, marshaler runtime.Marshaler, server APIServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_5.ArtifactCollectorArgs + var protoReq proto_2.ArtifactCollectorArgs var metadata runtime.ServerMetadata newReader, berr := utilities.IOReaderFactory(req.Body) @@ -1593,7 +1593,7 @@ var ( ) func request_API_GetToolInfo_0(ctx context.Context, marshaler runtime.Marshaler, client APIClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_6.Tool + var protoReq proto_5.Tool var metadata runtime.ServerMetadata if err := req.ParseForm(); err != nil { @@ -1609,7 +1609,7 @@ func request_API_GetToolInfo_0(ctx context.Context, marshaler runtime.Marshaler, } func local_request_API_GetToolInfo_0(ctx context.Context, marshaler runtime.Marshaler, server APIServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_6.Tool + var protoReq proto_5.Tool var metadata runtime.ServerMetadata if err := req.ParseForm(); err != nil { @@ -1625,7 +1625,7 @@ func local_request_API_GetToolInfo_0(ctx context.Context, marshaler runtime.Mars } func request_API_SetToolInfo_0(ctx context.Context, marshaler runtime.Marshaler, client APIClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_6.Tool + var protoReq proto_5.Tool var metadata runtime.ServerMetadata newReader, berr := utilities.IOReaderFactory(req.Body) @@ -1642,7 +1642,7 @@ func request_API_SetToolInfo_0(ctx context.Context, marshaler runtime.Marshaler, } func local_request_API_SetToolInfo_0(ctx context.Context, marshaler runtime.Marshaler, server APIServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_6.Tool + var protoReq proto_5.Tool var metadata runtime.ServerMetadata newReader, berr := utilities.IOReaderFactory(req.Body) @@ -1711,7 +1711,7 @@ func local_request_API_GetServerMonitoringState_0(ctx context.Context, marshaler } func request_API_SetServerMonitoringState_0(ctx context.Context, marshaler runtime.Marshaler, client APIClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_5.ArtifactCollectorArgs + var protoReq proto_2.ArtifactCollectorArgs var metadata runtime.ServerMetadata newReader, berr := utilities.IOReaderFactory(req.Body) @@ -1728,7 +1728,7 @@ func request_API_SetServerMonitoringState_0(ctx context.Context, marshaler runti } func local_request_API_SetServerMonitoringState_0(ctx context.Context, marshaler runtime.Marshaler, server APIServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_5.ArtifactCollectorArgs + var protoReq proto_2.ArtifactCollectorArgs var metadata runtime.ServerMetadata newReader, berr := utilities.IOReaderFactory(req.Body) @@ -1749,7 +1749,7 @@ var ( ) func request_API_GetClientMonitoringState_0(ctx context.Context, marshaler runtime.Marshaler, client APIClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_5.GetClientMonitoringStateRequest + var protoReq proto_2.GetClientMonitoringStateRequest var metadata runtime.ServerMetadata if err := req.ParseForm(); err != nil { @@ -1765,7 +1765,7 @@ func request_API_GetClientMonitoringState_0(ctx context.Context, marshaler runti } func local_request_API_GetClientMonitoringState_0(ctx context.Context, marshaler runtime.Marshaler, server APIServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_5.GetClientMonitoringStateRequest + var protoReq proto_2.GetClientMonitoringStateRequest var metadata runtime.ServerMetadata if err := req.ParseForm(); err != nil { @@ -1781,7 +1781,7 @@ func local_request_API_GetClientMonitoringState_0(ctx context.Context, marshaler } func request_API_SetClientMonitoringState_0(ctx context.Context, marshaler runtime.Marshaler, client APIClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_5.ClientEventTable + var protoReq proto_2.ClientEventTable var metadata runtime.ServerMetadata newReader, berr := utilities.IOReaderFactory(req.Body) @@ -1798,7 +1798,7 @@ func request_API_SetClientMonitoringState_0(ctx context.Context, marshaler runti } func local_request_API_SetClientMonitoringState_0(ctx context.Context, marshaler runtime.Marshaler, server APIServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { - var protoReq proto_5.ClientEventTable + var protoReq proto_2.ClientEventTable var metadata runtime.ServerMetadata newReader, berr := utilities.IOReaderFactory(req.Body) diff --git a/gui/velociraptor/src/App.js b/gui/velociraptor/src/App.js index b2ca46fe44c..6c751949647 100644 --- a/gui/velociraptor/src/App.js +++ b/gui/velociraptor/src/App.js @@ -17,6 +17,7 @@ import FullScreenNotebook from './components/notebooks/full_notebook.js'; import FullScreenHuntNotebook from './components/hunts/hunt-full-notebook.js'; import FullScreenFlowNotebook from './components/flows/flow-full-notebook.js'; import ArtifactInspector from './components/artifacts/artifacts.js'; +import Users from './components/users/users.js'; import VeloHunts from './components/hunts/hunts.js'; import UserDashboard from './components/sidebar/user-dashboard.js'; import Form from 'react-bootstrap/Form'; @@ -144,6 +145,7 @@ class App extends Component { + diff --git a/gui/velociraptor/src/components/i8n/en.js b/gui/velociraptor/src/components/i8n/en.js index c89fc919674..b5361d92dfb 100644 --- a/gui/velociraptor/src/components/i8n/en.js +++ b/gui/velociraptor/src/components/i8n/en.js @@ -166,7 +166,84 @@ const English = { "_ts": "Server Time", "TablePagination": (from, to, size)=> <>Showing { from } to { to } of { size }, - + "Verified Email" : "Verified Email", + "Account Locked" : "Account Locked", + "Role_administrator" : "Server Administrator", + "Role_org_admin" : "Organization Administrator", + "Role_reader" : "Read-Only User", + "Role_analyst" : "Analyst", + "Role_investigator" : "Investigator", + "Role_artifact_writer" : "Artifact Writer", + "Role_api" : "Read-Only API Client", + "ToolRole_administrator" : + <> + Like any system, Velociraptor needs an administrator which is all powerful. This account can run arbitrary VQL on the server, reconfigure the server, etc. The ability to add/create/edit/remove users is dependent on the organizations to which this account belongs. + , + "ToolRole_org_admin" : + <> + This role provides the ability to manage organizations. It would typically be used together with another role. + , + "ToolRole_reader" : + <> + This role provides the ability to read previously collected results but does not allow the user to actually make any changes. This role is useful to give unpriviledged users visibility into what information is being collected without giving them access to modify anything. + , + "ToolRole_analyst" : + <> + This role provides the ability to read existing collected data and also run some server side VQL in order to do post processing of this data or annotate it. Analysts typically use the notebook or download collected data offline for post processing existing hunt data. Analysts may not actually start new collections or hunts themselves. + , + "ToolRole_investigator" : + <> + This role provides the ability to read existing collected data and also run some server side VQL in order to do post processing of this data or annotate it. Investigators typically use the notebook or download collected data offline for post processing existing hunt data. Investigators may start new collections or hunts themselves. + , + "ToolRole_artifact_writer" : + <> + This role allows a user to create or modify new client side artifacts (They are not able to modify server side artifacts). This user typically has sufficient understanding and training in VQL to write flexible artifacts. Artifact writers are very powerful as they can easily write a malicious artifact and collect it on the endpoint. Therefore they are equivalent to domain admins on endpoints. You should restrict this role to very few people. + , + "ToolRole_api" : + <> + This role provides the ability to read previously collected results but does not allow the user to actually make any changes. + , + "ToolPerm_all_query" : "Issue all queries without restriction", + "ToolPerm_any_query" : "Issue any query at all (AllQuery implies AnyQuery)", + "ToolPerm_pubish" : "Publish events to server side queues (typically not needed)", + "ToolPerm_read_results" : "Read results from already run hunts, flows, or notebooks", + "ToolPerm_label_clients" : "Can manipulate client labels and metadata", + "ToolPerm_collect_client" : "Schedule or cancel new collections on clients", + "ToolPerm_collect_server" : "Schedule new artifact collections on Velociraptor servers", + "ToolPerm_artifact_writer" : "Add or edit custom artifacts that run on the server", + "ToolPerm_server_artifact_writer" : "Add or edit custom artifacts that run on the server", + "ToolPerm_execve" : "Allowed to execute arbitrary commands on clients", + "ToolPerm_notebook_editor" : "Allowed to change notebooks and cells", + "ToolPerm_server_admin" : "Allowed to manage server configuration", + "ToolPerm_org_admin" : "Allowed to manage organizations", + "ToolPerm_impersonation" : "Allows the user to specify a different username for the query() plugin", + "ToolPerm_filesystem_read" : "Allowed to read arbitrary files from the filesystem", + "ToolPerm_filesystem_write" : "Allowed to create files on the filesystem", + "ToolPerm_machine_state" : "Allowed to collect state information from machines (e.g. pslist())", + "ToolPerm_prepare_results" : "Allowed to create zip files", + "ToolPerm_datastore_access" : " Allowed raw datastore access", + "ToolUser_verified_email" : "The email address for this user has been verified", + "ToolUser_locked" : "This account is locked.", + "ToolUsernamePasswordless" : + <> + This server is configured to authenticate users using an external authentication host. This account must exist on the authentication system for login to be successful. + , + "Add User" : "Add User", + "Update User" : "Update User", + "ToolRoleBasedPermissions" : + <> + Role-Based Permissions allow the administrator to grant sets of permissions for common activities. A user may have multiple roles assigned. + , + "ToolEffectivePermissions" : + <> + Roles are defined as sets of fine-grained permissions. This is the current set of permissions defined by the roles for this user. + , + "ToolOrganizations" : + <> + Organizations allow multiple tenants to use this Velociraptor server. If a user is not assigned to an organization, it is a member of the Organizational Root, which implies membership in all organizations. + , + "User does not exist": (username)=><>User {username} does not exist., + "Do you want to delete?": (username)=>"Do you want to delete " + username + "?", }; export default English; diff --git a/gui/velociraptor/src/components/sidebar/navigator.js b/gui/velociraptor/src/components/sidebar/navigator.js index db2f32916e6..5341de69fbc 100644 --- a/gui/velociraptor/src/components/sidebar/navigator.js +++ b/gui/velociraptor/src/components/sidebar/navigator.js @@ -151,6 +151,18 @@ class VeloNavigator extends Component { + + + + { disabled ? <>