topic HowTo - Creating an scpuser account on Gaia Clish in Firewall and Security Management

HowTo - Creating an scpuser account on Gaia Clish

Danny — Thu, 23 Apr 2026 07:13:04 GMT

While reviewing Check Point installations I often encounter setups where the shell of the admin user account was changed to /bin/bash in order to allow copying documents via scp to and from Check Point Gaia systems.

This is because the scponly shell isn't known.

Follow these steps to create an scpuser for copying documents securely without compromising your admin account.

[ R7x ]

add user scpuser uid 2600 homedir /home/scpuser set user scpuser shell /usr/bin/scponly set user scpuser password save config‍‍‍‍‍‍‍‍

[ R8x ]

add user scpuser uid 2600 homedir /home/scpuser set user scpuser realname Scpuser add rba role scpRole domain-type System readwrite-features expert add rba user scpuser roles scpRole set user scpuser gid 100 shell /usr/bin/scponly set user scpuser password save config‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: HowTo - Creating an scpuser account on Gaia Clish

PhoneBoy — Fri, 21 Jun 2019 08:57:16 GMT

Good tip, but I'm going to move it to the https://community.checkpoint.com/community/infinity-general/appliances-and-gaia?sr=search&searchId=12a9c53d-212e-45ec-be2d-434e5ee01d24&searchIndex=1‌ forum

Re: HowTo - Creating an scpuser account on Gaia Clish

Astardzhiev — Mon, 04 Sep 2017 13:51:04 GMT

Indeed it is very good tip, however you have to tweak little bit group permissions I believe... The reason is that if you create a capture with tcpdump (with admin user) and then try to download it via scp (using scpuser) you will not be allowed. I have faced something similar recently.

Re: HowTo - Creating an scpuser account on Gaia Clish

Quinn_Yost — Tue, 05 Sep 2017 13:57:25 GMT

I've adopted an old-school approach to the inability to read/write. When creating the home directory for the scp user, I make sure to `chmod g+s` that directory. This causes all subsequent files created there to be created with the group assigned to the directory rather than the group of the creating user. Then when a tcpdump or similar is created, I specify the scp user's home directory as the path for the file.

Similarly, I only scp to the scp user's home directory and then move files around with the expert user.

Re: HowTo - Creating an scpuser account on Gaia Clish

Markusevc — Sat, 14 Oct 2017 20:07:34 GMT

Enabling SFTP

This alternative example describes how to enable SFTP access on a Security Gateway using the default “admin” account. Note: a Security Policy must already contain a rule that allows connections via SSH.

1. Connect via command line using the default “admin" account
2. Navigate to expert mode
3. Backup the current /etc/ssh/sshd_config file

cp /etc/ssh/sshd_config /etc/ssh/sshd_config_original

4. Edit the current /etc/ssh/sshd_config file:

vi /etc/ssh/sshd_config

5. Below the sftp line

#Subsystem sftp /usr/libexec/openssh/sftp-server

Add:

Subsystem sftp internal-sftp

6. Save the changes and exit from vi editor.

7. Restart the SSHD daemon

/sbin/service sshd restart

8. Now you can connect with the gateway with an SFTP client using TCP port 22.

Re: HowTo - Creating an scpuser account on Gaia Clish

Alex_Lam1 — Mon, 13 May 2019 13:14:48 GMT

Thanks Danny.

That helps.

Wow R80.xx really changes a few stuffs 🙂

Re: HowTo - Creating an scpuser account on Gaia Clish

Denis_Spirin — Mon, 16 Sep 2019 08:54:09 GMT

But what to do with permissions? Do you allow scpuser read access to /var/log? Do you create a specific folder, that belongs to scpuser? Manually setting permissions might be cumbersome.

Re: HowTo - Creating an scpuser account on Gaia Clish

G_W_Albrecht — Tue, 17 Sep 2019 07:22:01 GMT

This is a real relevation for Mac OS users - now we can connect using Cyberduck instead of WinSCP !

Is this sftp server also available on Embedded GAiA units ?