topic Re: Need to Rename or disable GAIA Admin Account in Firewall and Security Management

Need to Rename or disable GAIA Admin Account

Duminda_SAT — Thu, 10 Feb 2022 16:27:44 GMT

Hi Please help me to Disable or Rename GAIA Admin account due to compliance requirements.

Thank you,

Duminda Lakmal.

Re: Need to Rename or disable GAIA Admin Account

G_W_Albrecht — Thu, 10 Feb 2022 16:45:29 GMT

- Login to GAiA WebGUI

- on the left go to User Management > Users

- define new admin user with admin role

- select and edit the user admin to nologin role

Re: Need to Rename or disable GAIA Admin Account

the_rock — Fri, 11 Feb 2022 02:09:59 GMT

You cannot really disable or delete default admin account. As @G_W_Albrecht , you can create new admin account and then edit to give it a different name.

Re: Need to Rename or disable GAIA Admin Account

_Val_ — Fri, 11 Feb 2022 07:45:24 GMT

I am curious, what exact compliance issues are there with that admin account?

Re: Need to Rename or disable GAIA Admin Account

HeikoAnkenbrand — Fri, 11 Feb 2022 09:08:10 GMT

Note:
If it is an SMS and you also use the "admin" account in the SmartConsole, you must also change the account with "cpconfig".

Re: Need to Rename or disable GAIA Admin Account

Bob_Zimmerman — Fri, 11 Feb 2022 16:55:21 GMT

A lot of assessors don't like default usernames (like 'admin' specifically on Check Point boxes), predictable usernames (like 'admin', 'root', 'Administrator', and so on), or accounts with admin privileges whose usernames identify them as admin accounts (like 'BobZAdmin').

I routinely get all three complaints from assessors for every single box I manage.

Re: Need to Rename or disable GAIA Admin Account

the_rock — Fri, 11 Feb 2022 16:58:54 GMT

I think you would have to pay someone at CP a LOT of money to change that : - )

Re: Need to Rename or disable GAIA Admin Account

Bob_Zimmerman — Fri, 11 Feb 2022 18:02:37 GMT

The "BobZAdmin" example is because it's also a compliance issue if administrators don't have separate accounts for administrative actions, but the compliance assessors don't like the privileged accounts to have the substring "admin" in their usernames.

The default username 'admin' hits all three of those compliance complaints.

Setting its password hash to "*" is enough to prevent a user from logging in as 'admin', and doesn't risk breaking other stuff. Specifically, setting the shell to /sbin/nologin causes interactive sessions to fail, so if you log in as an unprivileged user (logging in as UID 0 is yet another compliance issue), you can't elevate to root privileges.

Re: Need to Rename or disable GAIA Admin Account

PhoneBoy — Fri, 11 Feb 2022 21:43:54 GMT

Re: Need to Rename or disable GAIA Admin Account

_Val_ — Sat, 12 Feb 2022 14:16:45 GMT

Open an RFE 🙂

Re: Need to Rename or disable GAIA Admin Account

masher — Tue, 15 Feb 2022 15:52:52 GMT

This is also documented in sk112163.

- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112163