https://community.checkpoint.com/t5/Scripts/CP-gateway-baseline-check-script/m-p/269308#M1422 <P>Somewhat similar to CIS script Danny Jung posted recently. dos2unix and chmod 777 needed.</P> <P>Example from my lab:</P> <P>&nbsp;</P> <P><BR />[Expert@CP-GW:0]# ./cp_gateway_baseline_check.sh<BR />Check Point Gateway Baseline Security Check<BR />Timestamp: Fri Jan 30 17:47:57 EST 2026<BR />Threshold: MAX_POLICY_AGE_DAYS=30<BR />--------------------------------------------<BR />INFO - Version (top lines):<BR />Product version Check Point Gaia R82<BR />OS build 777<BR />OS kernel version 4.18.0-372.9.1cpx86_64<BR />OS edition 64-bit<BR />--------------------------------------------<BR />FAIL - NTP does not appear enabled (show ntp active output: No).<BR />PASS - NTP servers are configured (show ntp servers).<BR />IP Address Type Version Preferred</P> <P>ntp2.checkpoint.com server 4 no<BR />ntp.checkpoint.com server 4 yes<BR />--------------------------------------------<BR />FAIL - Management 'allowed-client' looks too permissive (found any-host/any/0.0.0.0/0).<BR />Type Address Mask Length</P> <P>Host Any<BR />--------------------------------------------<BR />FAIL - SSH password authentication appears enabled (passwordauthentication yes).<BR />FAIL - SSH root login appears enabled (permitrootlogin yes).<BR />--------------------------------------------<BR />PASS - SIC trust is established (cp_conf sic state).<BR />--------------------------------------------<BR />PASS - Policy installed recently (1 days ago) per fw stat.<BR />INFO - fw stat line: localhost LAB-POLICY-Andy 29Jan2026 8:08:14 : [&gt;eth0] [&lt;eth0] [&gt;eth1] [&gt;eth2]<BR />--------------------------------------------<BR />WARN - App Control (appi) update status not up-to-date/unclear:</P> <P>Update status: new<BR />Update description: Gateway was updated with database version: 21012601.<BR />Next update description: The next update will be run as scheduled.<BR />DB version: 21012601<BR />WARN - URL Filtering (urlf) update status not up-to-date/unclear:</P> <P>Update status: new<BR />Update description: Gateway was updated with database version: 21012601.<BR />Next update description: The next update will be run as scheduled.<BR />DB version: 21012601<BR />PASS - Anti-Bot / Anti-Virus (antimalware) databases appear up-to-date.<BR />--------------------------------------------<BR />INFO - Cluster state (informational):</P> <P>HA module not started.</P> <P>This gateway not configured as cluster<BR />--------------------------------------------<BR />Summary: PASS=4 WARN=2 FAIL=4<BR />[Expert@CP-GW:0]#</P> Fri, 06 Feb 2026 15:14:26 GMT the_rock 2026-02-06T15:14:26Z https://community.checkpoint.com/t5/Scripts/CP-gateway-baseline-check-script/m-p/269308#M1422 2 Fri, 06 Feb 2026 15:14:26 GMT https://community.checkpoint.com/t5/Scripts/CP-gateway-baseline-check-script/m-p/269308#M1422 the_rock 2026-02-06T15:14:26Z