topic Re: After proceeding sk181171, cli connection is not possible in General Topics

After proceeding sk181171, cli connection is not possible

bund — Fri, 12 Apr 2024 08:26:04 GMT

Hi everyone

I'm going to create a user through the document.

https://support.checkpoint.com/results/sk/sk181171

The onetime scripts were successfully completed.

But I can't access web and cli through the new user.

It shows 'permission denied.'

Why is this being denied?

When you can't access through cli, is there a new way to create a new user?

With a password policy on it and my account locked, and no account knowing my password, is there a way to create a new user?

Thank you in advance.

Re: After proceeding sk181171, cli connection is not possible

PhoneBoy — Fri, 12 Apr 2024 17:35:03 GMT

Version/JHF?
Where exactly are you seeing "permission denied"?
Screenshots might be helpful also.

A TAC case might be quicker, though: https://help.checkpoint.com

Re: After proceeding sk181171, cli connection is not possible

the_rock — Fri, 12 Apr 2024 19:43:01 GMT

I just tested it in R81.20 and worked fine.

Andy

Re: After proceeding sk181171, cli connection is not possible

bund — Tue, 16 Apr 2024 00:47:24 GMT

My version is R81.10. Take 132

This is standalone. However, the same symptoms appear in distributed.

The denial of permission appears in the WebUI.
The CLI cannot be accessed even if a password is entered.

Re: After proceeding sk181171, cli connection is not possible

the_rock — Tue, 16 Apr 2024 00:59:25 GMT

Just to make sure, admin account works, just not the new user, right? If so, I would check one thing. Navigate to /etc/ssh, then look for file called sshd_config, VI the file and search for PasswordAuth, make sure all those lines say yes, there should be 5 of them I think. If not, change them, save the file, try again.

Andy

Re: After proceeding sk181171, cli connection is not possible

bund — Tue, 16 Apr 2024 04:25:37 GMT

Existing administrator accounts work well.

It looks like this in sshd_config.

The line searched for 'Pass' is as follows.

Even if I change the content, my new user cannot access it.

vi /etc/ssh/sshd_config

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords yes
PasswordAuthentication yes

#KerberosOrLocalPasswd yes

Match address X.X.200.200,0::0/0,0.0.0.0/0
PasswordAuthentication yes

Re: After proceeding sk181171, cli connection is not possible

the_rock — Tue, 16 Apr 2024 11:50:42 GMT

Not sure what to say, sorry...I also tested this in R81.10, no issues. I would contact TAC to see if they can help.

Andy