topic Re: set expert password-hash using autoconf.clish doesnt' work in Spark Firewall (SMB)

set expert password-hash using autoconf.clish doesnt' work

Antonio_Martins — Wed, 27 May 2020 00:35:13 GMT

HI CheckMates,

I'm trying to configure expert password using set expert password-hash in autoconf.clish but it doesn't work. I.e the command is accepted but expert password doesn't work.

Strangely user admin password, that was configured the same way (using set administrator username admin password-hash in autoconf.clish) works fine!

Hash obtained either using "cryptpw -a md5 <password>” or ‘openssl passwd -1”,

What am I doing wrong?

Re: set expert password-hash using autoconf.clish doesnt' work

funkylicious — Wed, 27 May 2020 10:26:37 GMT

Hi,

You can generate the MD5 has from /sbin/grub-md5-crypt , then copy the saltedhash and do a set expert-password-hash <hash> .

Should work just fine like this.

Re: set expert password-hash using autoconf.clish doesnt' work

Antonio_Martins — Thu, 28 May 2020 23:13:21 GMT

Hi,

Same result. Admin password hash works fine, expert password hash doesn't:

GW000 login: admin
Password:
GW000> expert
Enter expert password:
Wrong password, exiting.

By the way, I'm testing in 1200R gateway.

Re: set expert password-hash using autoconf.clish doesnt' work

PhoneBoy — Fri, 29 May 2020 01:23:08 GMT

I have a feeling the dollar signs in the password hash are getting interpreted by the shell.
Enclose the hashed string in single quotes.

Re: set expert password-hash using autoconf.clish doesnt' work

HristoGrigorov — Fri, 29 May 2020 03:24:44 GMT

sk119633 may help with this

Re: set expert password-hash using autoconf.clish doesnt' work

Antonio_Martins — Tue, 02 Jun 2020 12:01:58 GMT

Enclose the hashed string in single quotes didn't solved it.

Re: set expert password-hash using autoconf.clish doesnt' work

Antonio_Martins — Tue, 02 Jun 2020 13:37:29 GMT

The way I found to set expert password-hash using autoconf.clish was to set the password in clish and then copy the value from /flash/expert_pass_ to file.

I guess the hashing algorithm for expert password is not MD5 as it is with admin password hashes.

Re: set expert password-hash using autoconf.clish doesnt' work

G_W_Albrecht — Wed, 03 Jun 2020 07:45:42 GMT

R77.20.87 CLI Guide:

set expert password

Description

Sets the initial password or password hash for the expert shell

Syntax

set expert {password|password-hash} {<pass>|<pass_hash>}

Parameters

Parameter	Description
pass	Password using alphanumeric and special characters
pass_hash	Password MD5 string representation

Example

set expert password-hash $1$fGT7pGX6$oo9LUBJTkLOGKLhjRQ2rw1

Output

Success shows OK. Failure shows an appropriate error message.

Comments

To generate a password-hash, you can use this command on any Check Point SMB Appliance gateway (as an expert user).

cryptpw –a md5 <password string>

If this works on CLI only it would be an autoconf.clish limitation - you could even involve TAC !

Re: set expert password-hash using autoconf.clish doesnt' work

Antonio_Martins — Thu, 04 Jun 2020 08:14:29 GMT

Example.

[Expert@GW000]# cryptpw -a md5 ClearPassw0rd
$1$byBwFTca$iOzMEY5EfDZ/deRgXaXKi1
[Expert@GW000]# exit

...

Gateway-ID-7F99045E> set expert password-hash $1$byBwFTca$iOzMEY5EfDZ/deRgXaXKi1
Setting expert password with hash
OK
Gateway-ID-7F99045E> expert
Enter expert password:
Wrong password, exiting.

Anyone else with the same issue?

Re: set expert password-hash using autoconf.clish doesnt' work

G_W_Albrecht — Thu, 04 Jun 2020 09:17:47 GMT

You should involve TAC, this sounds like incorrect behaviour !

Re: set expert password-hash using autoconf.clish doesnt' work

TJ_Aus — Tue, 09 Sep 2025 12:47:12 GMT

Very old thread I know, however I had a need to change the expert password on a number of 1500 series Quantum Spark firewalls running the recommended R81.10.17 firmware with the Digicert patch
So, to do it from a script you need to work out the hash first. The following works in the scenario provided above but note the command is slightly different:

In expert mode on a 1500 where the new password is "NewPassword":
#cryptpw NewPassword -m md5
$1$EV4ZvIAH$1sNhoXVHRjznDvV9nOB7G/

Then go to clish on the 1500:
set expert password-hash $1$EV4ZvIAH$1sNhoXVHRjznDvV9nOB7G/

Then use the above command to script the change of expert password on all the other 1500s as desired Always test it first

Re: set expert password-hash using autoconf.clish doesnt' work

G_W_Albrecht — Tue, 09 Sep 2025 12:52:23 GMT

The slightly different command makes no difference at all, so your post is just superfluous:

- if you just use #cryptpw NewPassword md5 will be always used by default

- to use -m or -a makes no difference at all and is not needed if you want md5 be used

Re: set expert password-hash using autoconf.clish doesnt' work

TJ_Aus — Tue, 09 Sep 2025 13:03:31 GMT

Yes, I was referring to the cryptpw command . The -a doesn't work in case someone tries and yes, the command you just posted works.

Re: set expert password-hash using autoconf.clish doesnt' work

G_W_Albrecht — Tue, 09 Sep 2025 13:23:02 GMT

You mean -a does not work in scripts, but -m does ? You did not write that...

Syntax in CLI is:

BusyBox v1.36.1 (2024-03-18 18:58:40 IST) multi-call binary.
Usage: cryptpw [-P FD] [-m TYPE] [-S SALT] [PASSWORD] [SALT]
Print crypt(3) hashed PASSWORD
-P N Read password from fd N
-m TYPE des,md5,sha256/512 (default )
-S SALT

But -a (old syntax afaik) does work in CLI, and default is md5.

Re: set expert password-hash using autoconf.clish doesnt' work

TJ_Aus — Tue, 09 Sep 2025 13:32:55 GMT

Correct, -a doesn't work. -m works but isn't needed as you pointed out, just md5 is required plus the password

Re: set expert password-hash using autoconf.clish doesnt' work

G_W_Albrecht — Tue, 09 Sep 2025 13:58:34 GMT

No, md5 is not required as it is the default, so cryptpw password will be sufficient. cryptpw -m sha512 password will give a hash starting with $6 denoting sha-512. I see no script used in your post, and in expert mode on a 1500 -a SHA512 will work. I have tested the following script on a 1600:

#!/bin/sh
cryptpw -a sha512 karin

Output is:


[Expert@sweet-sixteen]# ./test.sh
$6$WUar.r5CXaB6JlQj$aNrkcJXFfP/esvcQB4GkF0XgOZMLf0Rr3WHwR57aAFG/ZMCUwr37HzAGE4iSPusQFRtCzRir4ZLlW8oiwhVd41

No error using -a ! So i see no use in your post...

Re: set expert password-hash using autoconf.clish doesnt' work

TJ_Aus — Wed, 10 Sep 2025 05:41:44 GMT

Thanks for your kind reply, it is very helpful as I didn't know -a or -m weren't needed and that MD5 was default as it looked like SHA was the default from the command output
My point was that in an earlier post, -a was used which doesn't work for me. See the output. I don't get an error, I just get the help. I was looking to script it, but it didn't work when I typed it manually. I later found -m worked and didn't investigate further as I got what I needed

Yes we don't need to use -m md5 but -m md5 works if it is used regardless if it is needed or not. The command works if I use -m or if I don't use -m. See below:

# cryptpw –a md5 NewPassword
BusyBox v1.36.1 (2024-03-18 18:58:40 IST) multi-call binary.

Usage: cryptpw [-P FD] [-m TYPE] [-S SALT] [PASSWORD] [SALT]

Print crypt(3) hashed PASSWORD

-P N Read password from fd N
-m TYPE des,md5,sha256/512 (default )
-S SALT

# cryptpw -m md5 NewPassword
$1$pztzUpMk$wCHZ57cZzc6p1lpDKJ/TR0
# cryptpw NewPassword
$1$OWyL25XG$uw3.N0yi1el.tPLXS.M6P/
# fw ver
This is Check Point's 1570 Appliance R81.10.17 - Build 654

Re: set expert password-hash using autoconf.clish doesnt' work

G_W_Albrecht — Wed, 10 Sep 2025 10:15:15 GMT

Very strange ! Both my SMBs accept -a - maybe that option was removed in .17 - but is still present in R82.00.00 ?

The last test above was from a 1600 Appliance

My other testing device gives:

[Expert@fifteenfifty]# fw ver

This is Check Point's 1550 Appliance R81.10.15 - Build 913

[Expert@fifteenfifty]# cryptpw -a md5 karin

$1$KBNQMt5v$OdQeEqdBdT7MTSJ27MiqH.

Re: set expert password-hash using autoconf.clish doesnt' work

TJ_Aus — Thu, 11 Sep 2025 02:54:29 GMT

Roger that, mine is on a different release and is a 1570

Re: set expert password-hash using autoconf.clish doesnt' work

G_W_Albrecht — Thu, 11 Sep 2025 06:55:59 GMT

1550 or 1570 makes no difference in BusyBox commands, but the release / build will.