topic Re: Python modules in checkpoint in API / CLI Discussion

Python modules in checkpoint

DPB_Point — Thu, 08 Nov 2018 09:29:23 GMT

HI!

I am trying to install the requests python module in a R80.10 Management server, and as I have seen, it hasnt the pip utility. Does anyone know how to install the module?

Re: Python modules in checkpoint

Martin_Valenta — Thu, 08 Nov 2018 10:47:57 GMT

There is no pip and never will be I guess. You can try to import module locally, meaning upload .py files to management station and import in script. What's the use case to run python script from mgmt station?

Re: Python modules in checkpoint

DPB_Point — Fri, 09 Nov 2018 08:17:14 GMT

Ok but I am trying to install the modules locally but i cant, because when I try to install requests module the system asks me for the setuptools modules and when I try to install the setuptools it asks me for distutils.core and when I try to install distutils it asks me for distutils so I cant continue. I´m trying to convert the python file in executable, but the .spec file that I have generated cannot be run by the mgmt server so I am a little bit blocked(I have generated it in a Fedora in order to get a similar enviroment).

The use case is the following, we are trying to disable a group of policies which have a determinate comment, If we would have a problem, we disable the rules that could generate them(critical service) and we solve the problem quickly.

I have also tried to install pip with the get_pip.py script but it doesnt work.

Re: Python modules in checkpoint

PhoneBoy — Fri, 09 Nov 2018 23:41:17 GMT

The python that is available on Check Point appliances is not meant to be used for general purpose.

As a result, we only put the specific modules and features we explicitly use and disable everything else.

In fact, any script has to be explicitly whitelisted before running.

Re: Python modules in checkpoint

Joshua_Hatter — Sat, 10 Nov 2018 02:40:52 GMT

This isn't the case anymore in R80. You can run any python files without whitelist.

Re: Python modules in checkpoint

PhoneBoy — Sat, 10 Nov 2018 05:42:17 GMT

Yeah, but it's still a pretty stripped down Python

Re: Python modules in checkpoint

DPB_Point — Mon, 12 Nov 2018 08:14:04 GMT

So do you think that I couldnt work with libraries such as requests? the thing is that I need to include the python script in the management server either way. So that would generate a problem to me, do you know if there is a way to become the script in a executable? I have tried pyinstaller utility in a Fedora that is a similar to the Checkpoint enviroment but I cannot execute the executable which is generated as I have told before. Any solution would be welcomed.

Re: Python modules in checkpoint

PhoneBoy — Mon, 12 Nov 2018 13:41:41 GMT

What is it you are actually trying to do?

Clearly run some sort of python script, but to do what exactly?

Re: Python modules in checkpoint

Joshua_Hatter — Mon, 12 Nov 2018 14:06:39 GMT

You aren't going to be able to install non-standard library with a package manager. I've never tried it but it should work, you will need to copy in requests + all it's dependencies to the management server and it might work.

I haven't had much luck with pyinstaller with Check Point myself, I did try it once.

Re: Python modules in checkpoint

DPB_Point — Tue, 13 Nov 2018 08:21:45 GMT

What I have done remotely is cretae a python script which through web services, disables a group of rules by the comment they have. Doing that we can disable each rule which has a critical service by the execution of the script. But, I need to have the ability of executing the script in the management server because of the proyect details.

Joshua Hatter, I have added all the dependencies but when i am trying to execute their setup.py they ask me for more dependencies as I have commented before. I reached at one point in which I couldnt install the distutils module which is needed for the rest of the modules.

Re: Python modules in checkpoint

Joshua_Hatter — Tue, 13 Nov 2018 13:36:10 GMT

First of all, you should do your best to not have to run this from the management server. The API can accept remote calls.

Second, as I mentioned you cannot install packages from the Management server itself, which is what the setup.py does. It reads from a dict the 'install_requires' fields and tries to install through distUtils the dependencies.

I've just tested to verify for you, that this indeed does work. Once you move requests and all it's dependencies to the machine you can execute against them.

Re: Python modules in checkpoint

lennyb — Sun, 08 Mar 2020 13:43:31 GMT

This python is 32bit.

Is it possible and how to install python2 x86_64?