topic Re: Extend local users expiration - local API bash scripts in Scripts

Extend local users expiration - local API bash scripts

Tomas_Vobruba — Thu, 08 Dec 2022 08:16:48 GMT

Hi all,

I was asked by customer to help him with writing script to change expiration of local users. Our API from version 1.6.1 can handle this task quite easily.

There are two scripts:

Extend expiration of selected user: script_change_expiration_of_selected_user.sh

https://gist.github.com/chkp-mkoldov/1f2ea190c6888be3f46091f815813d73

Extend expiration of all local users: script_change_expiration_of_users.sh

https://gist.github.com/chkp-mkoldov/b030dc7cf5feb5230d4bfd77c4c1377b

Take this script as a skeleton. It might be changed in any kind of the manner.

Cheers Tomas

Re: Extend local users expiration - local API bash scripts

vturan — Sun, 20 Nov 2022 16:09:58 GMT

Hello Tomas,

Is there any template script to get an output like in the last screenshot above that checks the expiration time for all users (or specific users whose name includes @VPN@)? Can it also show users' e-mail address details? And my last question is, can we print this output to a file with a command to be added to the script and copy it to a remote location such as ftp etc?

Note: Version R80.40

Regards,

Volkan

Re: Extend local users expiration - local API bash scripts

Tomas_Vobruba — Sun, 20 Nov 2022 18:23:24 GMT

Hello,

script just reads on input user names, but mgmt_cli itself can give you what are you looking for, but you have to change select from one user "command show user" to multi user select:

https://sc1.checkpoint.com/documents/latest/APIs/index.html#cli/show-users~v1.8.1%20

As you can see, management cli is returning name, so you can easy ask for that:

[Expert@cp-mgmt:0]# mgmt_cli -r true show users --format json|jq '.objects[] |select((.name)|contains("vpn")).name'
user_vpn
user1_vpn

reading this specified email for output name of user can be done for example by:

mgmt_cli -r true show users details-level full --format json | jq -r '.objects[] | select(.name | contains ("vpn")) | .email'

user_vpn@test.com

user1_vpn@test.com

Both together:

mgmt_cli -r true show users details-level full --format json | jq -r '.objects[] | select(.name | contains ("vpn")) | [.email,.name]'

[
"user_vpn@test.com",
"user_vpn"
]

Hope this is what you are looking for.

Tomas

Re: Extend local users expiration - local API bash scripts

CihanB — Mon, 05 Dec 2022 07:54:15 GMT

Hello, is it possible to export this output to a .csv file and schedule a job to periodically update/create this file? Or do we have to do manually whole process?

Re: Extend local users expiration - local API bash scripts

PhoneBoy — Mon, 05 Dec 2022 15:23:54 GMT

Yes, jq (used in the CLI commands above) can also output in CSV…with the correct format.
And, yes, once you have worked out the correct CLI command that gives you the data in the format you want, you can have it run by cron periodically.

Re: Extend local users expiration - local API bash scripts

Tomas_Vobruba — Mon, 05 Dec 2022 16:01:21 GMT

Hi, sorry for later reply.

output:

"user_vpn","user_vpn@test.com"
"user1_vpn","user1_vpn@test.com"