topic Re: Creating users via script/using CPDIR on SMB Devices in Spark Firewall (SMB)

Creating users via script/using CPDIR on SMB Devices

SaffaRamma — Fri, 10 Jun 2022 15:26:03 GMT

I know it is possible to execute commands from a management server (SMS) to a centrally managed SMB via CPDIR. For example, the below command works a treat (PS - 10.20.30.40 is not an actual IP I'm using):

$CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /bin/clish -c "show configuration"

What does seem to be an issue however is the ability to add local administrators this way (I have tried multiple iterations of the below)?

$CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /bin/clish -c "add user newadmin type admin password this_is_my_real_password permission RW"
Unexpected error: attempt to index global 'cgilua' (a nil value)

$CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /bin/clish -c "add administrator username newadmin password-hash $1$UHVNJb2O$1UXMqCZm9767DZNtoIqYv. permission read-write"
Could not set administrator password-hash: Not valid password hash
Could not set administrator password-hash: Not valid password hash

$CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /bin/clish -c "add administrator username newadmin password-hash '$1$UHVNJb2O$1UXMqCZm9767DZNtoIqYv.' permission read-write"
Could not set administrator password-hash: Not valid password hash
Could not set administrator password-hash: Not valid password hash

The above commands within the quotation marks work fine locally on the SMB device, but running the CPRID commands from the SMS fail with the errors in bold above.

Re: Creating users via script/using CPDIR on SMB Devices

PhoneBoy — Fri, 10 Jun 2022 15:40:29 GMT

Yes, it should be supported.
That said, the canonical path to clish on SMB appliances is /pfrm2.0/bin/clish
If that still doesn't work, recommend a TAC case.

Re: Creating users via script/using CPDIR on SMB Devices

SaffaRamma — Fri, 10 Jun 2022 15:54:58 GMT

Thanks for the quick response! Tried the change in canonical path ($CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /pfrm2.0/bin/clish -c "add user testuser type admin password testuser123password permission R") and still no dice! I'll get a ticket raised with TAC.

Re: Creating users via script/using CPDIR on SMB Devices

Bärbel — Wed, 08 Mar 2023 21:45:54 GMT

Was this solved by TAC? I'm also getting "Unexpected error: attempt to index global 'cgilua' (a nil value)" when trying to do something like this:

cprid_util -server 1.2.3.4 -verbose rexec -rcmd clish -c "set administrator session-settings inactivity-timeout 15"

Re: Creating users via script/using CPDIR on SMB Devices

G_W_Albrecht — Thu, 09 Mar 2023 15:46:31 GMT

Seems that some commands will not work, as found in sk106490: How to remotely reset Admin / Expert password on a Security Gateway:

This procedure is NOT supported for Gaia Embedded appliances. If you attempt to run this command on a Gaia Embedded appliance, you will receive the following error: "Unexpected error: attempt to index global 'cgilua' (a nil value)"

There is also a procedure using different syntax to achieve the same on SMBs:

sk106025 - How to reset the Expert mode password on a Quantum Spark Appliance with Gaia Embedded OS

You could try to use a script on SMB, first lines:

#!/bin/bash -f
source /fwtmp/opt/fw1/tmp/.CPprofile.s

and call it with the needed parameter values using cprid_util command.

Re: Creating users via script/using CPDIR on SMB Devices

Hugo_vd_Kooij — Mon, 17 Jul 2023 11:55:04 GMT

Nice try. But then you get a lua error. so that doesn't work either.

Re: Creating users via script/using CPDIR on SMB Devices

nmelay2 — Wed, 22 Oct 2025 23:18:04 GMT

Well, it seems like some Lua code in clish is trying to access the USER environment variable while it's not been set by CPRID, hence the nil value error.

You need to set it first:

cprid_util -server <ip> -verbose putenv -attr USER -val admin cprid_util -server <ip> -verbose rexec -rcmd clish -c 'set administrator username <adminuser> password-hash "<hash>" permission read-write'

The putenv command should remain in effect until the gateway is rebooted.