topic Re: Change Expiration Date Users in General Topics

Change Expiration Date Users

Tho — Mon, 16 Jan 2023 16:24:03 GMT

Hello,

I would like to know how we can adjust the expiration date without going through all users one by one.

Thanks in advance.

Re: Change Expiration Date Users

PhoneBoy — Tue, 17 Jan 2023 00:01:31 GMT

Use a script to do it.
See: https://community.checkpoint.com/t5/Scripts/Extend-local-users-expiration-local-API-bash-scripts/m-p/106575#M736

Re: Change Expiration Date Users

Tho — Tue, 17 Jan 2023 13:40:57 GMT

We will test it, thank you.

Re: Change Expiration Date Users

Tho — Wed, 18 Jan 2023 00:06:38 GMT

Hello PhoneBoy,

This is what I get back when we are running the script:

jq: error: Cannot iterate over null
Logout failed
Checking expiration time of all users...

What am I doing wrong?

Re: Change Expiration Date Users

PhoneBoy — Tue, 17 Jan 2023 21:25:56 GMT

What version/JHF of management are you running?
I believe the script requires R80.40 with the latest recommended JHF or above.

Re: Change Expiration Date Users

Tho — Tue, 17 Jan 2023 21:47:12 GMT

We are running R81.10 take 335.

Re: Change Expiration Date Users

Tho — Wed, 18 Jan 2023 00:07:14 GMT

This is the script we are using:

#!/bin/bash
# Created by tvobruba
# version 001
# script is checking and changing expiration date for all internal users in CP MGMT database
# usage: chmod 700 && ./script.sh

date=1609459162000 #setup checked date in ms epoch time - 2020-12-31 16:45
new_date="2036-01-31" #setup new desired date in ISO format

# export list of users to file
mgmt_cli -r true show users --format json |jq '.objects[].name' > list.txt

echo "Checking expiration time of all users..."
echo -e "";
for user in `cat ./list.txt`; do

expiration=`mgmt_cli -r true show user name $user --format json |jq '."expiration-date".posix'`
echo User: $user, $expiration
echo ""

if [ $date \> $expiration ];
then
echo "$user will expire before 31.12.2020 23:55";
echo "Setting new expiration..."
echo ""
mgmt_cli -r true set user name $user expiration-date "$new_date" --format json
else
echo "$user will expire not before: `date -d @$( echo "($expiration + 500) / 1000" | bc)`";
fi;

done

rm -f ./list.txt

Re: Change Expiration Date Users

PhoneBoy — Tue, 17 Jan 2023 22:20:46 GMT

What does the following command show?

mgmt_cli -r true show users --format json

Note this script may not work as-is (especially if you have more than 500 users) and will require modifications to get you the desired result.

Re: Change Expiration Date Users

Tho — Wed, 18 Jan 2023 00:15:05 GMT

This is what the command shows:

{
"code" : "generic_error",
"message" : "Error 404. The Management API service is not available. Please check that the Management API server is up and running."
}

Logout failed

I already checked the API service is up and running.

When I run the command 'api status' it shows me this info:

When running mgmt_cli commands add '--port 44 34'

We have close to 400 users at the moment.

Re: Change Expiration Date Users

Tho — Wed, 18 Jan 2023 00:21:26 GMT

When I run the same command and I add --port 4434 at the end (mgmt_cli -r true show users --format json --port 4434) it shows me a bunch of users, so that works now.

Re: Change Expiration Date Users

PhoneBoy — Wed, 18 Jan 2023 00:47:21 GMT

If you've changed the default port, yes, you will have to modify the script accordingly as mgmt_cli assumes port 443 otherwise.

Re: Change Expiration Date Users

Tho — Wed, 18 Jan 2023 00:56:41 GMT

Ok, I modified the script a tiny bit:

#!/bin/bash
# Created by tvobruba
# version 001
# script is checking and changing expiration date for all internal users in CP MGMT database
# usage: chmod 700 && ./script.sh

date=1609459162000 #setup checked date in ms epoch time - 2020-12-31 16:45
new_date="2036-01-31" #setup new desired date in ISO format

# export list of users to file
mgmt_cli -r true show users --format json --port 4434 |jq '.objects[].name' > list.txt

echo "Checking expiration time of all users..."
echo -e "";
for user in `cat ./list.txt`; do

expiration=`mgmt_cli -r true show user name $user --format json --port 4434 |jq '."expiration-date".posix'`
echo User: $user, $expiration
echo ""

done

rm -f ./list.txt

The script is now running and it's checking the expiration date of the users that start with letter a, b and c and then it stops.

Example:

"x" will expire not before: Sat Jan 31 00:00:00 CET 2026
User: "x", 1769814000000

"x" will expire not before: Sat Jan 31 00:00:00 CET 2026

We already changed the expiration date of some users to 31-1-2026 (manually).

How to go from here?

Re: Change Expiration Date Users

PhoneBoy — Wed, 18 Jan 2023 01:15:30 GMT

I suspect you have more users than the result of "show users" will return on its own.
Which means you will need to make multiple calls to show users with the "offset" parameter to get all the users.
This exact issue was discussed here: https://community.checkpoint.com/t5/API-CLI-Discussion/Export-Users-with-Specific-Expiry-amp-and-Valid-Certificate/m-p/166616/highlight/true#M7390

Re: Change Expiration Date Users

Hugo_vd_Kooij — Wed, 18 Jan 2023 06:39:46 GMT

This is how I took care of it automatically:

# Validate API status, exit 101 if not running
APISTATUS=`api status|grep 'API Status'|awk '{print $4}'`
if [ "$APISTATUS" != "Started" ]; then
echo "API Server is not available but $APISTATUS"
exit 101
fi

# Get API port, set MMGMT CLI accordingly
APIPORT=`api status|grep "Gaia Port"|awk '{print $4}'`
MGMTCLI="mgmt_cli --port $APIPORT"

So you can use the SMGMT_CLI command on every SmartCenter.

Re: Change Expiration Date Users

Tho — Wed, 18 Jan 2023 12:51:21 GMT

Script is working now, this got the job done:

#!/bin/bash
# script is checking and changing expiration date for all internal users in CP MGMT database
# usage: chmod 700 && ./script.sh

date=1704037500139 #setup checked date in ms epoch time - 2023-12-31 16:45
new_date="2026-01-31" #setup new desired date in ISO format

offset=0
echo "Checking expiration time of all users..."
echo -e "";
while true; do
users_list=$(mgmt_cli -r true show users offset $offset limit 50 --format json --port 4434 |jq '.objects[].name')
if [ "$users_list" = "[]" ]; then
break
fi
for user in $users_list; do
expiration=`mgmt_cli -r true show user name $user --format json --port 4434 |jq '."expiration-date".posix'`
echo User: $user, $expiration
echo ""

if [ $date \> $expiration ];
then
echo "$user will expire before 31.12.2023 23:55";
echo "Setting new expiration..."
echo ""
mgmt_cli -r true set user name $user expiration-date "$new_date" --format json --port 4434 > /dev/null
else
echo "$user will expire not before: `date -d @$( echo "($expiration + 500) / 1000" | bc)`";
fi;
done
offset=$((offset+50))
done

Thanks @PhoneBoy

Re: Change Expiration Date Users

Tho — Wed, 18 Jan 2023 12:52:15 GMT

Thanks Hugo, will try this.

Re: Change Expiration Date Users

PhoneBoy — Wed, 18 Jan 2023 17:08:26 GMT

Clever!