topic Re: Disable inactive local users via API? in API / CLI Discussion

Disable inactive local users via API?

Marko_Keca — Wed, 18 Aug 2021 10:56:33 GMT

Hello all,

Is it possible to disable inactive local users via API?

We have request from our customer to automate process for checking local users and disable them if they are not used for VPN access more than 30 days?

Users are locally created and authenticated over RADIUS (OTP).

Thanks in advance!

Regards,
--
Marko

Re: Disable inactive local users via API?

PhoneBoy — Wed, 18 Aug 2021 13:55:47 GMT

Unfortunately last login is not something that is tracked in the user record on our end.
I suppose you can look for logins in the logs by querying the logs for that user and seeing if they logged in at all in the last 30 days.
Or query the RADIUS server logs for this information.
Then use the API to delete the relevant user via the API.

Re: Disable inactive local users via API?

_Val_ — Wed, 18 Aug 2021 15:21:01 GMT

You need to go over several steps here:

query all defined users and save to the list
run the list over VPN logs to see which where not logged in during the last month. To do that, you will need to keep at least 31 days of logs available. make a list of candidates to remove
run delete user over the list from step 2

Re: Disable inactive local users via API?

Marko_Keca — Fri, 20 Aug 2021 10:55:48 GMT

Hello Val, PhoneBoy,

Thanks for quick reply and suggestions!
We'll try to do it on RADIUS or SIEM.

I'm also thinking about creating LogExporter configuration to send only login events to separate syslog server to decrease amount of logs we need to parse. We can then parse the logs and get list of users for required period.

Regards,
--
Marko

Re: Disable inactive local users via API?

_Val_ — Fri, 20 Aug 2021 11:00:00 GMT

Why on a third party? You have VPN logs on Check Point side, and a user is mentioned in the log upon RAS VPN login.

Re: Disable inactive local users via API?

Marko_Keca — Fri, 20 Aug 2021 11:11:38 GMT

Hi Val,

How can I search/parse logs from CLI/Bash? I need to automate it as much as possible.

Customer is using Splunk as SIEM, so there is possibility we can make most of the job there, as logs are already sent to Splunk.
I'm thinking of something like this:
https://community.splunk.com/t5/Splunk-Search/Search-for-Users-that-have-not-Logged-in-in-the-Last-30-Days/m-p/141903

But we don't have access to Splunk, as another team is responsible for it.

If we can automate it somehow on CP only, it would be great, cause then we will not depend on other teams and vendors

Regards,
--
Marko

Re: Disable inactive local users via API?

_Val_ — Fri, 20 Aug 2021 11:59:08 GMT

You can run a SmartView report and export it to csv. One of the ways is explained in sk117773. Splunk also is a way, of course, if you send the related logs there