topic Re: Admin password hash in Firewall and Security Management

Admin password hash

Simon_Macpherso — Thu, 18 Nov 2021 01:15:50 GMT

Trying to set the admin account password using a password hash but I can't log in after it has been set.

Tried with R80.40 and R81.10.

Configuring via a bash script which runs on a stand-alone AWS Cloudguard gateway post-deployment.

Generating password using SHA256 / SHA512: openssl passwd -6 PASSWORD

Have also tried MD5: openssl passwd -1 PASSWORD

Password hash is assigned to a variable $pwd_hash and the following is run

clish -c "set user admin password-hash $pwd_hash" -s

Are there any caveats I should be aware of when using password-hash with with of these software versions?

Re: Admin password hash

PhoneBoy — Thu, 18 Nov 2021 01:29:21 GMT

MD5 hash is the default I believe.
And the example here suggests you’re doing the right thing, but I think you can specify it as part of the deployment: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104080&partition=Basic&product=vSEC

Re: Admin password hash

Simon_Macpherso — Thu, 18 Nov 2021 06:48:18 GMT

I suspect the cloud-init.sh script isn’t been run during terraform apply.

I have a similar problem with deploying a stand-alone AWS CloudGuard gateway in to an existing VPC using the CloudGuard Network Security Gateway Terraform module for AWS.

In the module that creates the AWS EC2 instance, a bash script is called to complete post-deployment configuration on the instance, including configuring the admin password.

However, even though the script resides in the correct location it script does not appear to be getting called.

I'm using Terraform v1.0.9 on Windows.

Re: Admin password hash

PhoneBoy — Thu, 18 Nov 2021 22:41:31 GMT

If cloud-init.sh isn't running, that sounds like a bug.
Suggest a TAC case.

Re: Admin password hash

Simon_Macpherso — Fri, 19 Nov 2021 02:09:39 GMT

It seems to be any bash script

I'm using terraform to deploy the stand-alone AWS CloudGuard gateway.

I’m using the templatefile function to reference a batch script.

In the aws_instance resource, for user_data im passing the raw data via a bash script with associated variables.

i.e. user_data = templatefile("${path.module}/gw_user_data.sh", {vars}

The bash script is located in the path of the module as specific by the interpolation above ${path.module}.

Validation and plan operations complete successfully.

However the gateway is not being configured with this data with the instance is launched.