topic Re: R80.20 restrict user access to perform only specific commands in Firewall and Security Management

R80.20 restrict user access to perform only specific commands

trawa05 — Fri, 27 Mar 2020 19:12:21 GMT

Hey,

I got a very specific requirement to allow a user access the gateway and get info about 3 things:
a) session table
b) NAT session table
c) arp table

So i am looking how i could create a user profile that could execute 3 (and only 3) specific commands on CLI.

I would be glad if you could come with any ideas.

Thank you!

Re: R80.20 restrict user access to perform only specific commands

PhoneBoy — Sat, 28 Mar 2020 02:41:07 GMT

Two topics you need to refer to in the Gaia Admin Guide: https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_Gaia_AdminGuide/html_frameset.htm
User Defined (Extended) Commands
Role Based Access

Between those two features, you can achieve what you're after.

Re: R80.20 restrict user access to perform only specific commands

trawa05 — Sun, 29 Mar 2020 20:19:35 GMT

I saw this info earlier already. Point is that User Defined (Extended) Commands requires path to the script.
I am not good at scripting, and what if i would like to create extended command for already existing command like 'fw ctl conntab'? Is there already script written for that in the system that i could point to in the extended command?

Re: R80.20 restrict user access to perform only specific commands

PhoneBoy — Sun, 29 Mar 2020 21:34:31 GMT

Giving access to generic binary like "fw" gives you access to a LOT of things.

To ensure only the appropriate commands can be run, you have to write a script that calls the necessary command(s).
This script would not be terribly complex.
In addition to the command you wish to run, make sure the appropriate environment variables are included, as shown here: https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Add-sources-inside-bash-scripts/m-p/72630

Another approach is to see if what you're after can be achieved through Dynamic CLI which adds a bunch of other commands to clish, which can be subject to Role-Based Access.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144112