topic Re: How to add new user into multiple gateways by 80.30 One Time Script Mgmt in Firewall and Security Management

How to add new user into multiple gateways by 80.30 One Time Script Mgmt

alexc88 — Mon, 05 Jul 2021 09:00:43 GMT

Hi, we have a new member of the team and we need to add his user to the gateways we manage (they are more than 100). After the management migration to 80.30 we find the One Time Script voice that can be useful. Is it possible create a script to launch once on all firewall in order to create the new user?

As per documentation, we used this command to every single firewall:

Add the user (in the example we are using the username indeni):
add user indeni uid 0 homedir /home/indeni
Set the password for the user:
set user indeni password
New password: [xxxx]
Verify new password: [xxxx]
Type the following to add the access role adminRole:
add rba user indeni roles adminRole
Type the following to set the shell to /bin/bash:
set user indeni shell /etc/cli.sh

Can we automate with a script? Thanks

Re: How to add new user into multiple gateways by 80.30 One Time Script Mgmt

_Val_ — Mon, 05 Jul 2021 09:45:54 GMT

It is really funny your new "team member" is called indeni 🙂

For the matter, yes you can script it with clish. Use set user password-hash instead of the password. Take hash from a known password, or generate with md5.

If it was not Indeni, I would actually recommend Radius user defined, but here you do need a local user.

For remote execution, I would recommend using cprid utility, ran on your MGMT server CLI:

$CPDIR/bin/cprid_util -server <IP_address_of_Security_Gateway> -verbose rexec -rcmd /bin/clish -s -c '<your single clish command'

This allows you to avoid admin authentication before you start dropping commands.

Send each new CLISH line with a separate command. Do not forget to use 'set config-lock on override' for the first one and then 'save config' for the last, on each GW.

Test your script before mass deployment 🙂