topic Expired Accounts view in R80.10 SmartConsole in Firewall and Security Management

Expired Accounts view in R80.10 SmartConsole

Marko_Keca — Fri, 10 Aug 2018 08:38:01 GMT

Hello all, can anyone point me where can Expired Accounts be found in R80.10 SmartConsole?

In R77.30 SmartDashboard it was in status bar.

Thanks in advance!

Regards,

Marko

Re: Expired Accounts view in R80.10 SmartConsole

Jerry — Fri, 10 Aug 2018 09:16:03 GMT

it depends if you use IA (Identity Awarness Blade) or just Management Account (those can be found in Management Administrators

Re: Expired Accounts view in R80.10 SmartConsole

Marko_Keca — Fri, 10 Aug 2018 09:27:57 GMT

We are using IA Blade, but user accounts with expiration set are local user accounts used for VPN access, not Management Administrators.

Re: Expired Accounts view in R80.10 SmartConsole

Jerry — Fri, 10 Aug 2018 09:31:35 GMT

Open Object Explorer from the TOP Menu and search for Users/Groups

Re: Expired Accounts view in R80.10 SmartConsole

Marko_Keca — Fri, 10 Aug 2018 09:42:32 GMT

If it would be so simple I wouldn't ask the question in first place

In Objects Explorer there is no column "Expiration date" or similar, which would be more than helpful

Re: Expired Accounts view in R80.10 SmartConsole

Jerry — Fri, 10 Aug 2018 09:46:26 GMT

sorry didn’t meant to insult or imply anything just wanted to help by giving a hint

now when you confirm that the question remains whether you guys use RADIUS or not ?

when you click that Expired Account on the bottom what does it say?

Re: Expired Accounts view in R80.10 SmartConsole

Marko_Keca — Fri, 10 Aug 2018 10:49:14 GMT

No insult taken. Just wanted to say I have exhausted all options I could find including CLI API, prior to asking question here.

All users are locally defined on Management server.

In R80.10 there is no Expired Account on bottom.

In R77.30 it opens window like this:

The only way I could see something similar i R80.10 is to open Mobile Access configuration, which opens old fashioned SmartDashboard, and then in Object List choose Users and Administrators, and sort it by expiration date.

My question is if there is a way to do it directly from R80.10 SmartConsole? I can't find how to do it.

Re: Expired Accounts view in R80.10 SmartConsole

Jerry — Fri, 10 Aug 2018 10:59:39 GMT

I got it so it effectively means your users were created for MAB not for using Management bit. Fine. So in terms of that there is no way you could see those users in new R80.10 as that build uses the same old-fashion way of MAB Management too.

When you on R80.10 and you use Mobile Access Blade your Management for those using it including users, their certs (those can be done also from R80.10 Users Management) is mainly via R77.30 Style Dashboard which comes up when you click it down on the Management Tab. So answering your question - no, you cannot manage those users from R80.10 SmartConsol as it redirects you anyway to old-style Dash with MAB Tab management.

hope it sorted it out

Jerry

Re: Expired Accounts view in R80.10 SmartConsole

Marko_Keca — Fri, 10 Aug 2018 11:19:06 GMT

Unfortunately not as we are not using MAB at all.

I just use the link in SmartConsole to launch old SmartDashboard and get Object List to see expired users. It is only workaround for something I should be able to see from SmartConsole itself.

Users and passwords are created thorough SmartConsole, and every user has expiration date set. Even if don't use it in any blade, any rule, I would like to see which ones are expired without opening each one of them.

Thanks for your help and suggestions! I don't mean to offend you, but I'm not sure you are getting the point what I'm asking

So I will rephrase my question:

Is it possible to see User account expiration field for multiple users at once in SmartConsole, without opening View for each user separately?

Re: Expired Accounts view in R80.10 SmartConsole

Jerry — Fri, 10 Aug 2018 11:47:36 GMT

alright then, I don't see any other option Marko and frankly I don't think there is any other than you've mentioned.

I tried the same in my lab just now and I see no option to see that by R80.10 SmartConsole I'm afraid.

Sorry to disappoint you but I think you're correct. The only way of doing what's your aim is to do that the way you just did explain.

Re: Expired Accounts view in R80.10 SmartConsole

JozkoMrkvicka — Sat, 11 Aug 2018 09:35:39 GMT

There is Global Properties settings for notification about expiration of UA:

Also this check is part of Compliance Blade, but there is in fact no information about specific Users, just expiration based on settings on Global Settings at all.+

That notification about accounts which are going to be expired in 14 days .... is missing....

Re: Expired Accounts view in R80.10 SmartConsole

Jerry — Sat, 11 Aug 2018 10:31:22 GMT

wrong! it wasn’t about Administrators but regular users

Re: Expired Accounts view in R80.10 SmartConsole

JozkoMrkvicka — Sat, 11 Aug 2018 11:33:19 GMT

I have meanwhile updated my comment

Re: Expired Accounts view in R80.10 SmartConsole

JozkoMrkvicka — Sat, 11 Aug 2018 11:40:23 GMT

Workaround using CLI:

echo -e "query users, administrator='false' \nquit" | dbedit -local | grep -E 'Object Name: |expiration_date:' | sed 's/Object Name://g' | sed 's/expiration_date://g' | sed 's/ //' | sed 's/        //'‍

Output from this command will be:

testing_user 1
14-Jun-2017
User_new
14-Aug-2018
User1
05-Aug-2018
user with space in the Name1
31-dec-2030

Compared with GUI:

Re: Expired Accounts view in R80.10 SmartConsole

Tomer_Sole — Sun, 12 Aug 2018 06:04:32 GMT

Hi everyone,

We will bring this feature to the Object Explorer in our next releases.

Indeed there are workarounds for now using dbedit CLI as well as opening SmartDashboard from a link such as the HTTPS Inspection etc. and then seeing it in the Object List - but these are workarounds, not our permanent solution.

Thank you for this feedback.

Re: Expired Accounts view in R80.10 SmartConsole

Marko_Keca — Mon, 13 Aug 2018 08:56:30 GMT

Thanks Jozko for CLI command!

I have improved it a little bit to get more formatted output:

echo -e "query users, administrator='false' \nquit" | dbedit -local | grep -E 'Object Name: |expiration_date:' | sed 's/Object Name://g' | sed 's/expiration_date://g' | sed 's/ //' | awk 'NR==1&&!/^ /{n=$0}NR!=1&&!/^ /{print n,p; n=$0; p="";}/^ /{p=p";"$0;}END{print n,p;}' | sed 's/        //' | sed 's/ ;/;/'

Re: Expired Accounts view in R80.10 SmartConsole

Marko_Keca — Mon, 13 Aug 2018 08:59:42 GMT

Thanks Tomer for the info.

Re: Expired Accounts view in R80.10 SmartConsole

Realeboga_Mashi — Wed, 02 Jan 2019 08:21:52 GMT

Thanks Jozko, to where does this command output the file to?

Below is the command I usually execute to extract all locally defined users:

==> fwm dbexport -f /tmp/VPN_Users_.xls

Then I will FTP the file out of the Manager to a desired location.

Re: Expired Accounts view in R80.10 SmartConsole

Realeboga_Mashi — Wed, 02 Jan 2019 09:15:16 GMT

Marko, can you output that to a text file?

Re: Expired Accounts view in R80.10 SmartConsole

JozkoMrkvicka — Wed, 02 Jan 2019 10:02:13 GMT

Just replace /path/to/folder/ to the desired location

echo -e "query users, administrator='false' \nquit" | dbedit -local | grep -E 'Object Name: |expiration_date:' | sed 's/Object Name://g' | sed 's/expiration_date://g' | sed 's/ //' | sed 's/        //' > /path/to/folder/users_expiration_dates.txt