# Create role with restricted access to hosts and services

**URL:** <https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673>\
**Category:** Icinga DB\
**Tags:** director\
**Created:** [June 4, 2024, 12:00pm UTC](https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673 "2024-06-04T12:00:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sziloo](https://community.icinga.com/user_avatar/community.icinga.com/sziloo/32/7843_2.png) [@sziloo](https://community.icinga.com/u/sziloo)\
**Post date:** [June 4, 2024, 12:00pm UTC](https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673/1 "2024-06-04T12:00:07Z")

</div>

Dear Community,

I am relative new at Icinga with some experience. I want to create a role which don’t have any right to some of the hosts and the services. My goal would be to create a role which has access to all devices, except for printers and their services.

I tried to create such role, but I did not find where should I restrict the access. As I understood, this place also depends on the modules I use. Currently I am using the IcingaDB and Icinga Director modules. Of course IcingaWeb2 is also installed. The Icinga monitoring module is not enabled.

---

<div class="post-metadata">

**Author:** ![rivad](https://community.icinga.com/user_avatar/community.icinga.com/rivad/32/5852_2.png) [@rivad](https://community.icinga.com/u/rivad)\
**Post date:** [June 4, 2024, 12:20pm UTC](https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673/2 "2024-06-04T12:20:51Z")

</div>

You can use Icingaweb2 filter syntax to restrict access.

First create a Dashboard with the required rules and then copy them into the filters of the modules - probably `icingadb/​filter/​objects` with the rule looking something like `hostgroup_name!=Printing|servicegroup_name!=Printing`

For the director you probably need to create a host group with all hosts except the printers to put into `director/​filter/​hostgroups`. You can use the same rule as above to attach the host group to the non printer hosts.

---

<div class="post-metadata">

**Author:** ![sziloo](https://community.icinga.com/user_avatar/community.icinga.com/sziloo/32/7843_2.png) [@sziloo](https://community.icinga.com/u/sziloo)\
**Post date:** [June 4, 2024, 1:01pm UTC](https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673/3 "2024-06-04T13:01:23Z")

</div>

Thanks, it is much better this way. I created the needed host and service groups also the filters on the dashboard. But the problems are still shown under Problems menu entry. Is there a way to “remove” them somehow from there?

---

<div class="post-metadata">

**Author:** ![rivad](https://community.icinga.com/user_avatar/community.icinga.com/rivad/32/5852_2.png) [@rivad](https://community.icinga.com/u/rivad)\
**Post date:** [June 4, 2024, 1:18pm UTC](https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673/4 "2024-06-04T13:18:12Z")

</div>

Not if you’re the admin and have access to all hosts.

The dashboard is only for excercise and testing. To restrict the role you need to fill the filters into the roles under [https://icinga.example.com/icingaweb2/role/list](https://icinga.example.com/icingaweb2/role/list).

---

<div class="post-metadata">

**Author:** ![sziloo](https://community.icinga.com/user_avatar/community.icinga.com/sziloo/32/7843_2.png) [@sziloo](https://community.icinga.com/u/sziloo)\
**Post date:** [June 4, 2024, 2:03pm UTC](https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673/5 "2024-06-04T14:03:00Z")

</div>

> [@rivad](#):
>
> The dashboard is only for excercise and testing.

Ok, that was my original problem. I dont know where to (to which section of the role editor) should I insert the filter.

---

<div class="post-metadata">

**Author:** ![rivad](https://community.icinga.com/user_avatar/community.icinga.com/rivad/32/5852_2.png) [@rivad](https://community.icinga.com/u/rivad)\
**Post date:** [June 4, 2024, 2:05pm UTC](https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673/6 "2024-06-04T14:05:21Z")

</div>

I would try `icingadb/​filter/​objects` and `director/​filter/​hostgroups` under the corresponding module (could need unfolding for details).

---

<div class="post-metadata">

**Author:** ![sziloo](https://community.icinga.com/user_avatar/community.icinga.com/sziloo/32/7843_2.png) [@sziloo](https://community.icinga.com/u/sziloo)\
**Post date:** [June 4, 2024, 2:44pm UTC](https://community.icinga.com/t/create-role-with-restricted-access-to-hosts-and-services/13673/7 "2024-06-04T14:44:23Z")

</div>

Thanks, its working 🙂