Ansible modules for cp_mgmt_user and cp_mgmt_user_facts

Duane_Toler — Thu, 30 May 2024 20:58:56 GMT

Here are new Ansible modules for managing locally defined users on a management server.

https://github.com/duanetoler/AnsibleModule-cp_mgmt_user.git

Main play task:

---
- name: Get local users
  check_point.mgmt.cp_mgmt_user_facts:
    details_level: full
  register: local_user_facts

- include_tasks: reset_passwords.yml
  loop: "{{ local_user_facts['ansible_facts']['users']['objects'] }}"
  loop_control:
    loop_var: user_item
    label: "{{ user_item.name }}"

- check_point.mgmt.cp_mgmt_publish:
    wait_for_task: true
...

reset_passwords.yml:

---
- name: "Generate new password | {{ user_item.name }}"
  set_fact:
    new_user_pwd: "{{ lookup('ansible.builtin.password', user_item.name+'.pw.txt length=15 chars=ascii_lowercase,ascii_uppercase,digits,.-_=@+') }}"

- debug:
    msg: "{{ user_item.name }}: {{ new_user_pwd }}"

- name: Set user password
  check_point.mgmt.cp_mgmt_user:
    name: "{{ user_item.name }}"
    password: "{{ new_user_pwd }}"
    authentication_method: "check point password"
    ignore_errors: true

...

Re: Ansible modules for cp_mgmt_user and cp_mgmt_user_facts

Duane_Toler — Thu, 30 May 2024 21:04:07 GMT

FYI, the cp_mgmt_user module has limited parameters, I'm afraid. This is meant for temporary use until R&D publishes their own official modules. It's meant just to handle the current CVE incident to reset local passwords.

topic Ansible modules for cp_mgmt_user and cp_mgmt_user_facts in Automation and APIs

Ansible modules for cp_mgmt_user and cp_mgmt_user_facts

Re: Ansible modules for cp_mgmt_user and cp_mgmt_user_facts