Gophish: Unable to manage content across multiple users/admins?

[hgpit]

What version of Gophish are you using?:
v0.11.0 on CentOS

Brief description of the issue:
All campaigns, sending profiles, etc are only visible by the admin who created it.

What are you expecting to see happen? :
We expected multiple users/admins to be able to manage the same campaign, or sending profiles, etc.

What are you seeing happen?
If 'admin1' creates a campaign, then 'admin2' logs in, 'admin2' is unable to see that the campaign or sending profiles even exist.

We have only just begun experimenting with this software today, so maybe this is intended to work like this, but it just seems counter-intuitive. We really need to be able to have many people logging in to manage the same content.

Thank you.

[glennzw]

Unfortunately all content is segmented between users - whatever email templates, landing pages, and sending profiles created and campaigns run will only be visible to that user (admin or not). Your only solution will be to have all your users log in with the same account.

I wrote this tool to allow easy copying of templates between profiles, which may be of use to you:

https://github.com/glennzw/phishPaste

[MakoWish]

Yeah, that is not a great design. As a security team, we need to collaborate on templates, landing pages, users and groups... essentially the entire platform needs to allow collaboration amongst a security team. We just set up an instance of this, and we are currently on a Teams meeting to start looking into it. We noticed as the presenter is creating things, we cannot see them, and we also noticed an admin can log in as any other user without that user's permission or knowledge?

I would love to revisit this project if things change, but it is not a good fit for us because of these two reasons we immediately noticed:

• No collaboration
• Ability for any admin user to log into any other user's account

[glennzw]

I think for your requirement you could all login with the same non-admin account.

Yes the admin user can login to user accounts, per design.

I know Jordan has plans for enhanced RBAC, but that's probably quite far down the line.

Best of luck!

[MakoWish]

Everybody using the same account is also poor security practice, as there would be no accountability for actions taken.

Allowing a user to _invite_ an admin to log into their account would be an acceptable option, but allowing any admin to log into a user's account without their knowledge is not a good idea at all.

[glennzw]

Thanks for the feedback.

Best of luck finding a suitable product!

[hgpit]

Thanks for confirming, @glennzw
We will see if we can live with it, but to echo @MakoWish, yeah it would be better to be able to have teams of people working on the same campaigns.
Aside from this, thanks for your time and hard work on this project :)