topic Re: Activate bashUser via script on a Embedded Gaia device? in Spark Firewall (SMB)

Activate bashUser via script on a Embedded Gaia device?

Johannes_Bachma — Tue, 07 Aug 2018 07:46:00 GMT

Hi,

it is possible to activate the bashUser via script on a Embedded Gaia device?

I want to execute the following command in expert mode "bashUser on" via a bat-script from a Windows client.

I tried it with the tool "plink". With this tool, I'm able to login and execute several commands in the clish. But I have to be in expert mode to execute the "bashUser on" command.

But I have problems after using "expert" to provide the expert-password via the script.

On a normal Gaia appliance I can use the following (but on Embedded Gaia there is not set command for the shell):

C:\ScriptingTest\plink.exe -ssh admin@192.168.0.1 -pw vpn123 set user admin shell /bin/bash

Any idea how I can solve this?

Best regards,

Johannes

Re: Activate bashUser via script on a Embedded Gaia device?

G_W_Albrecht — Tue, 07 Aug 2018 10:02:29 GMT

I fear that a script on a Win PC will not do - e.g. SSH will execute the given command in the default shell only, but you can see how this works from a CP SMS here: Reset Expert Password on an 1100

To activate bashUser, this would be:

$CPDIR/bin/cprid_util -server <IP of SMB> -verbose rexec -rcmd /bin/bash -c "bashUser on"

Re: Activate bashUser via script on a Embedded Gaia device?

Johannes_Bachma — Thu, 23 Aug 2018 11:58:38 GMT

Hi Günther,

thanks for your answer.

I tried it today with the cprid_util command you provided, also slightly different variations. But sadly non of them worked.

I got a "Current user cannot be determined" when using the command above.

I was only able to use cprid_util for clish commands like "show clock" for example when using:

$CPDIR/bin/cprid_util -server <IP of SMB> -verbose rexec -rcmd /bin/clish -c "show clock"

The appliances are managed via SmartProvisioing, I think that will not cause any problems here, since clish commands will work.But everytime I tried it with /bin/bash I got an error.

Best regards,

Johannes

Re: Activate bashUser via script on a Embedded Gaia device?

G_W_Albrecht — Thu, 23 Aug 2018 13:19:27 GMT

Very strange - i tested it again now, and on the first time, it worked, but any other try would give Current user cannot be determined.

Re: Activate bashUser via script on a Embedded Gaia device?

G_W_Albrecht — Thu, 23 Aug 2018 14:02:29 GMT

Very interesting - it works without issues on a locally managed 730, but only worked once on the 1200R.

Re: Activate bashUser via script on a Embedded Gaia device?

G_W_Albrecht — Fri, 24 Aug 2018 10:25:37 GMT

No, it does not - i did some tests together with our Linux Guru and found that the error only shows on centrally managed SMBs, but the command is not executed in both cases!

Reason:

- This command is only working when SIC has been established --> so locally managed SMBs are not supported.

- Embedded GAiA seems to be different, so it also does not work as it is on SMBs with existing SIC, but at least gives an error message...

Re: Activate bashUser via script on a Embedded Gaia device?

G_W_Albrecht — Fri, 24 Aug 2018 11:11:49 GMT

My collegue found the correct syntax needed to achieve this on centrally managed SMBs:

$CPDIR/bin/cprid_util -server <IP of SMB> -verbose rexec -rcmd /bin/bash -c "LOGNAME=admin bashUser on"
user: admin

Bash login enabled.
Scp access enabled.

Note:
        Your default shell will now be bash,
        and when you login you will enter expert mode.
        We recommend that you use clish as your default shell,
        and move to expert mode only when necessary.
        You can move from bash to clish using the "clish" command.
        To restore your default shell to clish run "bashUser off"

Seems that the environment variable LOGNAME is not set in Embedded GAiA...

Re: Activate bashUser via script on a Embedded Gaia device?

Johannes_Bachma — Fri, 24 Aug 2018 11:20:01 GMT

Thank you very much for your troubleshooting and testing. I really appreciate this.

I will try this command the next days

Re: Activate bashUser via script on a Embedded Gaia device?

G_W_Albrecht — Fri, 24 Aug 2018 12:11:24 GMT

Good Luck ! Please mark it as correct answer if it does also work for you.

Re: Activate bashUser via script on a Embedded Gaia device?

PhoneBoy — Mon, 27 Aug 2018 04:03:58 GMT

I tested it with my SMB appliances and it seems to work, so marking as correct

Re: Activate bashUser via script on a Embedded Gaia device?

Johannes_Bachma — Mon, 27 Aug 2018 06:47:30 GMT

The command also worked on my side. Thanks again Günther. This will help me a lot

Re: Activate bashUser via script on a Embedded Gaia device?

G_W_Albrecht — Mon, 27 Aug 2018 07:44:38 GMT

As a follow-up you can find here the relevant SKs:

sk119633 How to remotely reset Admin password on Centrally Managed 1100 / 1200R / 1400 appliance from a Security Management Server

and the original cprid_util SK:

sk101047 How to manage Security Gateway using the "cprid_util" tool

I also did some testing and have found that the LOGNAME seems only to be needed by bashUser - other commands will work the same without it:

# $CPDIR/bin/cprid_util -server 172.x.x.x -verbose rexec -rcmd /bin/bash -c "free"
              total         used         free       shared      buffers
Mem:       983408       831912       151496            0        25120
Swap:            0            0            0
Total:       983408       831912       151496

# $CPDIR/bin/cprid_util -server 172.x.x.x -verbose rexec -rcmd /bin/bash -c "fw ver -k"
This is Check Point's 1200R Appliance R77.20.75 - Build 286
kernel: R77.20.75 - Build 256

# $CPDIR/bin/cprid_util -server 172.28.8.177 -verbose rexec -rcmd /bin/clish -c "show diag"
Current system info
-----------------------------------
Image name: R77_990172286_20_75
Image version: 286
Bootloader version: 990170212
HW MAC Address: 00:1C:7F:
LAN MAC Address: 00:1C:7F:
DMZ MAC Address: 00:1C:7F:
Unit version: 1
Unit model: L61i
Marketing capabilities: 0
Marketing name: <Undefined>
ODM Hardware Revision: <Undefined>
Management opaque: Kb2XMJTTeWk=:xaYS3i++sLw=:zRlzLIL82ek=
Hardware capabilities: 1 - SD card
RTC status: OK
eMMC Initial bad blocks: 0
eMMC Current bad blocks: 0
eMMC Spare blocks: 118
HW monitor file system not found