topic Re: Massive users update passwords fwm dbimport in Firewall and Security Management

Massive users update passwords fwm dbimport

Dioklo — Wed, 16 Oct 2019 14:09:37 GMT

Hello,

In CP R77.30 I have to massively update vpn users (without LDAP).
I saw "fwm dbimport" but they say in manual (https://sc1.checkpoint.com/documents/R77/CP_R77_CLI_ReferenceGuide_WebAdmin/html_frameset.htm?topic=documents/R77/CP_R77_CLI_ReferenceGuide_WebAdmin/12590)
that The password should be encrypted with the C language encrypt function! But I don´t find what is this "C language encrypt function".
Any one has an idea?

Thanks

Re: Massive users update passwords fwm dbimport

PhoneBoy — Thu, 17 Oct 2019 23:57:28 GMT

If you upgrade to R80.x, which you should do now since R77.30 is End of Support, you should be able to use API commands.

Re: Massive users update passwords fwm dbimport

anstelios — Thu, 02 Apr 2020 20:45:08 GMT

We need to decrypt a massive amount of local users passwords from R77.30 fwm dbexport output in order to merge the users with the same passwords on a R80.30 environment.

Is it possible?

Re: Massive users update passwords fwm dbimport

PhoneBoy — Thu, 02 Apr 2020 21:33:27 GMT

Passwords are not encrypted in a reversible way, but are one-way hashes.
When you enter a password, it is hashed and compared to the stored (hashed) value.
Short of brute force tools, there's no practical way to decrypt the passwords.

The only supported way to migrate local users from R77.x to R80.x and maintain passwords is through the regular management upgrade process (CPUSE or Advanced Migration).
Outside of that, I don't know of a method for this while preserving the passwords.