topic Re: how to change admin passwords for multiple firewall at a time. is there a script in API / CLI Discussion

how to change admin passwords for multiple firewall at a time. is there a script

riyalsandeep1 — Sat, 26 Aug 2023 08:07:01 GMT

looking to change admin password for around 70 + firewalls. is there a script to change from management server.

Re: how to change admin passwords for multiple firewall at a time. is there a script

PhoneBoy — Sat, 26 Aug 2023 15:49:35 GMT

Changing the password programmatically will likely mean executing the following clish commands:

set user admin password-hash thehash
save config

Documented here: https://support.checkpoint.com/results/sk/sk92347
thehash comes from the output of cp_openssl passwd -1

To automate the execution on lots of firewalls, you can use something like https://community.checkpoint.com/t5/SmartConsole-Extensions/Execute-Commands-Simultaneously-SmartConsole-Extension/m-p/170383#M268

Re: how to change admin passwords for multiple firewall at a time. is there a script

riyalsandeep1 — Mon, 28 Aug 2023 19:57:52 GMT

thank you!! do we have any cli/api command that we can run via management server?

Re: how to change admin passwords for multiple firewall at a time. is there a script

PhoneBoy — Mon, 28 Aug 2023 23:50:45 GMT

You can use something like the following from the management: https://community.checkpoint.com/t5/API-CLI-Discussion/Central-Script-to-run-command-on-multiple-gateways/m-p/38948#M2383
See also https://support.checkpoint.com/results/sk/sk101047

Gaia has an API also: https://sc1.checkpoint.com/documents/latest/GaiaAPIs/index.html#introduction
And yes, you should be able to set a password that way.
You can make these API calls from the management.

There may be other examples in the community.

Re: how to change admin passwords for multiple firewall at a time. is there a script

Hugo_vd_Kooij — Tue, 29 Aug 2023 05:45:57 GMT

Mind you this will fail on SMB devices. Unless you create the hash on the same version SMB device. THere are some Secure Knowledge articles about this and you have to piece them together to get the proper picture so you know what works and what does not work.

As a practical hint. If you roll out a number of SMB devices make sure you have one or two to tinker with yourself as admin as there are practical limitations you rather find out in the lab then in the field.

Re: how to change admin passwords for multiple firewall at a time. is there a script

PhoneBoy — Tue, 29 Aug 2023 20:53:21 GMT

I think I ran into this issue recently…