cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question
Danny
Pearl

HowTo - Creating an scpuser account on Gaia Clish

 

While reviewing Check Point installations I often encounter setups where the shell of the admin user account was changed to /bin/bash in order to allow copying documents via scp to and from Check Point Gaia systems.

 

This is because the scponly shell isn't known.

 

Follow these steps to create an scpuser for copying documents securely without compromising your admin account.

 

[ R77.30 ]

add user scpuser uid 2600 homedir /home/scpuser
set user scpuser shell /usr/bin/scponly
set user scpuser password
save config‍‍‍‍‍‍‍‍

 

[ R80.x ]

add user scpuser uid 2600 homedir /home/scpuser
set user scpuser realname Scpuser
add rba role scpRole domain-type System readwrite-features expert
add rba user scpuser roles scpRole
set user scpuser gid 100 shell /usr/bin/scponly
set user scpuser password
save config‍‍‍‍‍‍‍‍‍‍‍‍‍‍

 

4 Replies
Admin
Admin

Re: HowTo - Creating an scpuser account on Gaia Clish

Good tip, but I'm going to move it to the ‌ forum Smiley Happy

0 Kudos
Astardzhiev
Nickel

Re: HowTo - Creating an scpuser account on Gaia Clish

Indeed it is very good tip, however you have to tweak little bit group permissions I believe... The reason is that if you create a capture with tcpdump (with admin user) and then try to download it via scp (using scpuser) you will not be allowed. I have faced something similar recently.

Quinn_Yost
Nickel

Re: HowTo - Creating an scpuser account on Gaia Clish

I've adopted an old-school approach to the inability to read/write.  When creating the home directory for the scp user, I make sure to `chmod g+s` that directory.   This causes all subsequent files created there to be created with the group assigned to the directory rather than the group of the creating user.  Then when a tcpdump or similar is created, I specify the scp user's home directory as the path for the file.

Similarly, I only scp to the scp user's home directory and then move files around with the expert user.

Employee+
Employee+

Re: HowTo - Creating an scpuser account on Gaia Clish

Enabling SFTP

This alternative example describes how to enable SFTP access on a Security Gateway using the default “admin” account. Note: a Security Policy must already contain a rule that allows connections via SSH.


1. Connect via command line using the default “admin" account
2. Navigate to expert mode
3. Backup the current /etc/ssh/sshd_config file

cp /etc/ssh/sshd_config /etc/ssh/sshd_config_original

4. Edit the current /etc/ssh/sshd_config file:

vi /etc/ssh/sshd_config


5. Below the sftp line

#Subsystem sftp /usr/libexec/openssh/sftp-server

Add:

Subsystem sftp internal-sftp


6. Save the changes and exit from vi editor.

7. Restart the SSHD daemon

/sbin/service sshd restart


8. Now you can connect with the gateway with an SFTP client using TCP port 22.