Roles and permissions

Each member has one role. The role applies to every firewall in pfCentral. API tokens act with the role of the member who made them.

Roles

Role	Read	Change configuration	Manage devices and members
Viewer	✓
Operator	✓	✓
Admin	✓	✓	✓
Owner	✓	✓	✓

The owner and admin roles do the same things today. The difference is in member management (below): only an owner can manage admins and owners.

What needs which role

Action	Viewer	Operator	Admin / Owner
Read configuration, live data and logs	✓	✓	✓
Create, edit, delete configuration (rules, aliases, NAT, interfaces, services, VPN, users, certificates…)		✓	✓
Apply changes		✓	✓
Start, stop, restart services		✓	✓
Add a device, make enrollment tokens, delete a device			✓
Reboot or shut down a firewall			✓
Diagnostics actions in the UI: ping, command prompt, delete ARP, table or state entries			✓
Run Traceroute or DNS Lookup (UI and API)			✓
Open Packet Capture, start or stop captures, read capture status, download PCAP (UI and API)			✓
Export the complete active configuration, including secrets (UI and API)			✓
Update the agent (Download & Restart)			✓
Install or remove packages			✓
Add a CA to the firewall’s OS trust store			✓
Invite members, change roles, disable members, make reset links			✓
Create and revoke your own API tokens	✓	✓	✓

UI and API differ for some diagnostics

In the API, ping and deleting ARP, pf table and config-backup entries need only the operator role. The UI asks for admin for those actions. Traceroute, DNS Lookup, command, reboot, halt and all packet-capture operations need admin in both. Config History lists and downloads remain available to viewers in both.

When a role is not enough, the UI shows Not permitted (or a 403 page) and the API answers 403. The refusal is written to the audit log.

Member management rules

• Only admins and owners can manage members.
• An admin can invite and manage operators and viewers only. An admin cannot change another admin or an owner.
• An owner can manage everyone, and can make other owners.
• Nobody can change their own role or disable their own account.
• The last owner cannot be demoted, disabled or removed.

When a member is disabled or their password is reset, their sessions end at the next request. A password reset also revokes their API tokens.

Turning checks off

PFCENTRAL_AUTHZ_ENFORCE=false lets every signed-in member do everything. Use it only to recover from a lockout, then turn it back on. The server logs a warning while it is off.

To recover a lost owner without it, run pf-central admin setup token and open the link. It creates a new owner.