# Potential risks with giving indices:data/read/scroll\* permission to all **URL:** \ **Category:** Search Guard\ **Created:** [February 4, 2019, 9:40am UTC](https://forum.search-guard.com/t/potential-risks-with-giving-indices-data-read-scroll-permission-to-all/1314 "2019-02-04T09:40:59Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Nikhil\_Utane](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@Nikhil\_Utane](https://forum.search-guard.com/u/Nikhil_Utane)\ **Post date:** [February 4, 2019, 9:40am UTC](https://forum.search-guard.com/t/potential-risks-with-giving-indices-data-read-scroll-permission-to-all/1314/1 "2019-02-04T09:40:59Z")
Hi, - Search Guard version: 6:6.3.1-22.3 - Elasticsearch version: 6.3.1 I have currently given default readall/readall access to all users of kibana as I don’t want them to make any changes to the visualizations. Unfortunately, this user does not have the required permission to generate reports. I read [here](https://github.com/floragunncom/search-guard/issues/319) that I need to “add “indices:data/read/scroll\*” to cluster level permissions:” sg\_roles.yml: # Read all, but no write permissions sg\_readall: readonly: true cluster: - CLUSTER\_COMPOSITE\_OPS\_RO - “indices:data/read/scroll\*” indices: ‘\*’: ‘\*’: - READ - indices:data/read/scroll/clear Wanted to understand what all the users will be able to do with above permissions? As I understand from [this](https://docs.search-guard.com/latest/roles-permissions), this should not give ‘write’ access so users will not be able to tamper with the data. But just want to be sure about that. -Thanks Nikhil ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [February 4, 2019, 9:50am UTC](https://forum.search-guard.com/t/potential-risks-with-giving-indices-data-read-scroll-permission-to-all/1314/2 "2019-02-04T09:50:22Z")
Your "sg\_readall" role does not give write access, so no risk that anyone who has solely this role can tamper with data. > **···** > > > Am 04.02.2019 um 10:40 schrieb Nikhil Utane \: > > > > Hi, > > > > \* Search Guard version: 6:6.3.1-22.3 > > \* Elasticsearch version: 6.3.1 > > > > I have currently given default readall/readall access to all users of kibana as I don't want them to make any changes to the visualizations. > > Unfortunately, this user does not have the required permission to generate reports. > > I read here that I need to "add "indices:data/read/scroll\*" to cluster level permissions:" > > > > sg\_roles.yml: > > # Read all, but no write permissions > > sg\_readall: > >   readonly: true > >   cluster: > >     - CLUSTER\_COMPOSITE\_OPS\_RO > >     - "indices:data/read/scroll\*" > >   indices: > >     '\*': > >       '\*': > >         - READ > >         - indices:data/read/scroll/clear > > > > Wanted to understand what all the users will be able to do with above permissions? > > As I understand from this, this should not give 'write' access so users will not be able to tamper with the data. But just want to be sure about that. > > > > -Thanks > > Nikhil > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/8c1040b7-b6f6-4542-90b9-e513872c1832%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/8c1040b7-b6f6-4542-90b9-e513872c1832%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Nikhil\_Utane](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@Nikhil\_Utane](https://forum.search-guard.com/u/Nikhil_Utane)\ **Post date:** [February 4, 2019, 10:23am UTC](https://forum.search-guard.com/t/potential-risks-with-giving-indices-data-read-scroll-permission-to-all/1314/3 "2019-02-04T10:23:05Z")
Thank you for quick response. > **···** > > On Mon, Feb 4, 2019 at 3:20 PM SG [info@search-guard.com](mailto:info@search-guard.com) wrote: > > > Your “sg\_readall” role does not give write access, so no risk that anyone who has solely this role can tamper with data. > > > > > Am 04.02.2019 um 10:40 schrieb Nikhil Utane [nikhil.subscribed@gmail.com](mailto:nikhil.subscribed@gmail.com): > > > > > > > > > > Hi, > > > > > > > > > > - Search Guard version: 6:6.3.1-22.3 > > > > > - Elasticsearch version: 6.3.1 > > > > > > > > > > I have currently given default readall/readall access to all users of kibana as I don’t want them to make any changes to the visualizations. > > > > > Unfortunately, this user does not have the required permission to generate reports. > > > > > I read here that I need to “add “indices:data/read/scroll\*” to cluster level permissions:” > > > > > > > > > > sg\_roles.yml: > > > > > # Read all, but no write permissions > > > > > sg\_readall: > > > > > readonly: true > > > > > cluster: > > > > > ``` > > > - CLUSTER_COMPOSITE_OPS_RO > > > > > > ``` > > > > > ``` > > > - "indices:data/read/scroll*" > > > > > > ``` > > > > > indices: > > > > > ``` > > > '*': > > > > > > ``` > > > > > ``` > > > '*': > > > > > > ``` > > > > > ``` > > > - READ > > > > > > ``` > > > > > ``` > > > - indices:data/read/scroll/clear > > > > > > ``` > > > > > > > > > > Wanted to understand what all the users will be able to do with above permissions? > > > > > As I understand from this, this should not give ‘write’ access so users will not be able to tamper with the data. But just want to be sure about that. > > > > > > > > > > -Thanks > > > > > Nikhil > > > > > > > > > > – > > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/8c1040b7-b6f6-4542-90b9-e513872c1832%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/8c1040b7-b6f6-4542-90b9-e513872c1832%40googlegroups.com). > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/35D341B1-553F-4A7C-AAD5-AE61A06AB9F5%40search-guard.com](https://groups.google.com/d/msgid/search-guard/35D341B1-553F-4A7C-AAD5-AE61A06AB9F5%40search-guard.com). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).