topic Re: Adding new local user using clish on Spark appliances in Spark Firewall (SMB)

Adding new local user using clish on Spark appliances

Pedro_Espindola — Tue, 18 Jul 2023 16:48:27 GMT

Hello Everyone,

I am trying to reconfigure a 1500 appliance using a CLI script exported from another appliance. However, the command to add a new local-user using password hash fails:

# clish -c 'show configuration' | grep local-user
add local-user name "test" password-hash "$5$uP8D78rQ$bYXgdHEoNfyynYHHkpMaHluTxtQkMGGkg.fFAffrtXC" is-temp-user "false"
# clish
> delete user test type local
> add local-user name test password-hash $5$uP8D78rQ$bYXgdHEoNfyynYHHkpMaHluTxtQkMGGkg.fFAffrtXC is-temp-user false
Could not set local-user password-hash: Not valid password hash
Could not set local-user password-hash: Not valid password hash

The reason why I want to do this is that I attempted a migration from R77.20.87 to R80.20.X, but I had a million problems and errors poping up and TAC is not being slow to respond. So I decided to configure from scratch using a script, but this would impact 20 local users if I am unable to create them.

Does anyone know how to make this command work?

PS: Adding administrators seems to work. The issue happens for local users (such as VPN users, etc).

The gateway is locally managed.

Re: Adding new local user using clish on Spark appliances

the_rock — Tue, 18 Jul 2023 17:55:47 GMT

Will test this shortly and update you.

Andy

Re: Adding new local user using clish on Spark appliances

the_rock — Tue, 18 Jul 2023 18:04:14 GMT

Lets see if SMB gurus can confirm, but the option seems pretty straight forward

Re: Adding new local user using clish on Spark appliances

PhoneBoy — Tue, 18 Jul 2023 21:06:58 GMT

There are two possible issues here:

The SMB appliance don't support SHA256 hashes (thus where the "not valid password hash" comes in).
When I try to use an MD5 hashed password (as suggested in the documentation), I get an "unknown error" when attempting to apply the command.

I'd try using an MD5-hashed password.
If it doesn't work on your version, please open a TAC case: https://help.checkpoint.com

Re: Adding new local user using clish on Spark appliances

Pedro_Espindola — Tue, 18 Jul 2023 21:39:05 GMT

Thanks for the suggestion.

The problem is that I don't have the passwords of all the users, so I wanted to export with show configuration and reimport in another clean installed gateway with the same model and firmware version.

The command that the SMB exports it cannot import. If it does not support SHA256 how is it exporting SHA256?

I suspected that there might be some salt that is exclusive to the box, so I ran the lines below in the same gateway, creating a user, exporting, deleting and importing, all in the same box and still it does not work:

> add local-user name test password vpn123
# clish -c 'show configuration' | grep local-user
add local-user name "test" password-hash "$5$uP8D78rQ$bYXgdHEoNfyynYHHkpMaHluTxtQkMGGkg.fFAffrtXC" is-temp-user "false"
# clish
> delete user test type local
> add local-user name test password-hash $5$uP8D78rQ$bYXgdHEoNfyynYHHkpMaHluTxtQkMGGkg.fFAffrtXC is-temp-user false
Could not set local-user password-hash: Not valid password hash
Could not set local-user password-hash: Not valid password hash

Re: Adding new local user using clish on Spark appliances

the_rock — Wed, 19 Jul 2023 01:05:32 GMT

I believe what @PhoneBoy said definitely sounds logical.

Andy

Re: Adding new local user using clish on Spark appliances

PhoneBoy — Wed, 19 Jul 2023 16:24:45 GMT

I recommend engaging with the TAC on this: https://help.checkpoint.com