topic SmartConsole Scripts Repository use cases and experience in API / CLI Discussion

SmartConsole Scripts Repository use cases and experience

Sven_Glock — Tue, 16 Oct 2018 14:16:52 GMT

Hi Community,

this week I recognized that I never have checked if there is a benefit in using SmartConsole's Scripts repository.

After reading https://community.checkpoint.com/community/secure-knowledge/blog/2018/10/01/article-of-the-week-check-point-packet-injector I decided to implement my first script which could be helpful on daily basis. It is calling the Packet Injector via SmartConsole and shows the result directly in the GUI without opening a dedicated ssh session.

Now I am interested to see which usecases you found for using the Scripts Repository in SmartConsole.

Please share your experience, your usecases or your code.

Thanks for sharing.

Cheers

Sven

Re: SmartConsole Scripts Repository usecases and experience

Sven_Glock — Tue, 16 Oct 2018 17:02:35 GMT

My Experience:

Generally I like the possibility to run scripts from the GUI.

But to be honest, I am not 100% happy with the implementation.

The way adding jobs to the "recent tasks list" makes it a bit uncomfortable to find the results.

I would like to see the results directly after executing the job.

Additionally there is some kind of time lag between the finish time of the job and the time when you can see the result.

I often click in the result and it is not showing what I expect to see. A few seconds later, the result shows my expected output.

More over I don't like the need to close the repository window before you are able to open the "recent tasks list" and check the results or selecting a different gateway to run the selected script on.

Why not implementing the repository window like the object explorer where you can click things in the background - like the "recent tasks list" - while the window remains opened.

Let me share my first two scripts:

PINJ Installer - A script to install Packet Injector to a R80 gateway

#!/bin/bash
curl_cli -o /home/admin/pinj.tgz ftp://someressources/pinj_v1.4.6_R80.10.tgz
tar -zxvf /home/admin/pinj.tgz
rpm -ihv CPPinj-R80-00.i386.rpm
echo "export PATH=$PATH:/opt/CPPinj-R80/" >> /home/admin/.bashrc
rm /home/admin/pinj.tgz CPPinj-R80-00.i386.rpm‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

PINJ Executor NON-VSX - A script to execure packet injector on a non-vsx gateway

##################################
#Arguments: <SRC-IP> <DST-IP> <dport> <tcp|udp>
##################################
#!/bin/bash
interface=$(ip route get $1 | head -1 | rev | cut -d " " -f 5 | rev)
sp=$(( RANDOM % (65535 - 1025 + 1 ) + 1025 ))
echo "Command: /opt/CPPinj-R80/pinj --sport $sp --dport $3 --protocol $4 -I $interface $1 $2"
/opt/CPPinj-R80/pinj --sport $sp --dport $3 --protocol $4 -I $interface $1 $2 2>/dev/null‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Since I start trying more complex scripts like a "Deployment agent offline updater" I experience some problems with timeouts or something like this.

But I have to dig deeper before getting more concrete.

Re: SmartConsole Scripts Repository usecases and experience

Ari_Heber — Sat, 20 Oct 2018 13:07:47 GMT

Hi Sven,

Thank you for your feedback, I'm taking your note into my attention.

As for the timeout, currently this is set to 2 minutes. I will continue to watch this thread in order to improve this feature.

Re: SmartConsole Scripts Repository usecases and experience

HristoGrigorov — Sun, 25 Nov 2018 05:01:16 GMT

Agree with Sven. Great idea with a bit fuzzy implementation. I hope CheckPoint elaborates on this and improves it in the future. I would start with more detailed execution logs, integrated job scheduler, mail reports, revisions...

Re: SmartConsole Scripts Repository use cases and experience

Sven_Glock — Thu, 14 Mar 2019 18:12:44 GMT

Today I tried to add the healthcheck script from sk121447 to the script repository.

Running this script on cli gives a nice quick overview about the health of the system.

Executing this script from the repository the output is like this:

Readable, but not nice.

So as an improvement: It would be nice if you could support colors and other font attributes.

Re: SmartConsole Scripts Repository use cases and experience

VENKAT_S_P — Tue, 30 Apr 2019 23:35:15 GMT

I am exactly trying the same thing with the healthcheck script, nice to know that the format is not similar to the one we like to see and this saved some time by seeing your output.

Re: SmartConsole Scripts Repository use cases and experience

Henrik_Noerr1 — Fri, 03 May 2019 10:22:05 GMT

How is healthcheck working for you? There is a max script size limit of 8kb. (in r80.10)

Healthcheck is +300kb

/Henrik

Re: SmartConsole Scripts Repository use cases and experience

Sven_Glock — Fri, 03 May 2019 11:15:46 GMT

Pretty simple. You have to copy the script locally on the relevant machine (gateway, management, etc.)

The script in the repository is just executing the script locally on the relevant machine.

Re: SmartConsole Scripts Repository use cases and experience

Henrik_Noerr1 — Mon, 06 May 2019 10:33:19 GMT

ofcourse! - Thanks

Re: SmartConsole Scripts Repository usecases and experience

Sven_Glock — Thu, 20 Feb 2020 21:09:38 GMT

@Ari_HeberAre there already plans for improvements?

Re: SmartConsole Scripts Repository use cases and experience

Sven_Glock — Tue, 10 Mar 2020 09:25:38 GMT

Hi Checkmates,

I found an other usecase.

I wanted to have CPPCAP (Link to relevant discussion about CPPCAP ) on all my gateways.

As it is not part of the installation until R80.40 you have to install it manually after every fresh installtion.
So I created a short script for my repository:

#!/bin/bash checkfile="/sbin/cppcap" if [ -f "$checkfile" ]; then echo "CPPCAP already installed" else HOST='FTPHOST' USER='user' PASSWD='somepass' ftpdir='remotedir' dir='localdir' #version check version=$(fw ver | awk '{print $7}') file='Check_point_'$version'_cp_pcap_sk141412.rpm' ftp -n $HOST <<END_SCRIPT quote USER $USER quote PASS $PASSWD cd $ftpdir bin lcd $dir get $file quit END_SCRIPT rpm -ivh --force --nodeps $dir/$file /etc/init.d/start_cppcap start rm $dir/$file echo "$file successfully installed" fi

The script is checking if CPPCAP is already installed, if not it checks the GAiA version to install the correct RPM for the specific version running on the gateway.
All you need is a ftp-server which hosts the relevant versions of CPPCAP. The rpm-files shoud have the same name, just the version related to the value in "fw ver" should be different.

Cheers
Sven

Re: SmartConsole Scripts Repository use cases and experience

Sven_Glock — Tue, 10 Mar 2020 09:18:54 GMT

Bye the way: Have you guys noticed that you can have global scripts in a multi-domanain-management? 8)

Re: SmartConsole Scripts Repository use cases and experience

Luis_Miguel_Mig — Wed, 25 Nov 2020 11:24:55 GMT

I see two user cases of the repository scripts:
- improve efficiency of checkpoint administrators

- allow checkpoint administrators to hand over operational tasks to other teams in the company

For the second case, I miss tighter access controls. I would be nice if you could define in the permission profiles what scripts is an user permitted to run. Also running scripts from the repository script requires super-user rights, it would be great if the scripts could be run with as little rights as possible.

Re: SmartConsole Scripts Repository usecases and experience

Sven_Glock — Fri, 27 Nov 2020 18:54:15 GMT

@Ari_Heber : Are you still responsible for Smart Console Script Repository?
If yes: Please join our discussion 8)
If no: Can you say who is responsible now?

Thanks in advance,

Sven

Re: SmartConsole Scripts Repository use cases and experience

Alex- — Mon, 16 Jan 2023 09:19:18 GMT

The timeout is still present.

I made a script which uses mgmt_cli to make API calls for a large number of policies (25+) in a given SMS, then publish and install each policy, check for the installation and so on.

I have noticed that the task still times out after a couple of minutes while the script completes everything it should do.

So, users see a failed task when everything is actually completed. Increasing or allowing a custom task timer would be welcome.

Re: SmartConsole Scripts Repository use cases and experience

Robin_H — Wed, 21 Feb 2024 16:17:50 GMT

Hello!

This post is rather old but especially regarding the script repository, I basically couldn´t find any other related discussion.

I just recently discovered the possibility of running scripts via SmartConsole.

My first application was initiating a snapshot on all devices prior to JHF installation.

clish -c "add snapshot 2024_01_15 desc prior_Take130"

Second use case was creation of an additional local user.

clish -c 'add user USR uid 0 homedir /home/USR' clish -c 'add rba user USR roles adminRole' clish -c 'set user USR shell /bin/bash' clish -c 'set user USR realname "XYZ"' clish -c 'set user USR newpass PW'

Especially here, I´d like to work with the arguments you can give prior to actually running the script but the manual is really sparse on how to use it. Will it just attach one argument to whatever command you have in the script or can you use variables?

Re: SmartConsole Scripts Repository use cases and experience

Sven_Glock — Fri, 23 Feb 2024 20:10:35 GMT

Using arguments is not a big deal:

I hope this is anwering your question.

Cheers

Sven