HowTo - Creating an scpuser account on Gaia Clish

[Danny]

While reviewing Check Point installations I often encounter setups where the shell of the admin user account was changed to /bin/bash in order to allow copying documents via scp to and from Check Point Gaia systems.

This is because the scponly shell isn't known.

Follow these steps to create an scpuser for copying documents securely without compromising your admin account.

[ R7x ]

add user scpuser uid 2600 homedir /home/scpuser
set user scpuser shell /usr/bin/scponly
set user scpuser password
save config‍‍‍‍‍‍‍‍

[ R8x ]

add user scpuser uid 2600 homedir /home/scpuser
set user scpuser realname Scpuser
add rba role scpRole domain-type System readwrite-features expert
add rba user scpuser roles scpRole
set user scpuser gid 100 shell /usr/bin/scponly
set user scpuser password
save config‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[ R82.10+ ] Run the code below in expert mode before running the above R8x Clish commands:

[ -e /usr/bin/scponly ] || { echo -e '#!/bin/sh\n[ "$#" -eq 2 ] && [ "$1" = "-c" ] && [ "$2" = "/usr/libexec/openssh/sftp-server" ] && exec "$2"; logger -t scponly "Denied login for $(id -un) ARGS=[$*]"; exit 1' > /usr/bin/scponly; chmod 755 /usr/bin/scponly; }; grep -qxF /usr/bin/scponly /etc/shells || cp /etc/shells /etc/shells.orig && echo /usr/bin/scponly >> /etc/shells

You can safely restore the original /etc/shells file after running the R80x Clish commands via: mv /etc/shells.orig /etc/shells

[PhoneBoy]

Good tip, but I'm going to move it to the https://community.checkpoint.com/community/infinity-general/appliances-and-gaia?sr=search&searchId=1...‌ forum

[Astardzhiev]

Indeed it is very good tip, however you have to tweak little bit group permissions I believe... The reason is that if you create a capture with tcpdump (with admin user) and then try to download it via scp (using scpuser) you will not be allowed. I have faced something similar recently.

[Quinn_Yost]

I've adopted an old-school approach to the inability to read/write.  When creating the home directory for the scp user, I make sure to `chmod g+s` that directory.   This causes all subsequent files created there to be created with the group assigned to the directory rather than the group of the creating user.  Then when a tcpdump or similar is created, I specify the scp user's home directory as the path for the file.

Similarly, I only scp to the scp user's home directory and then move files around with the expert user.

[Markusevc]

Enabling SFTP

This alternative example describes how to enable SFTP access on a Security Gateway using the default “admin” account. Note: a Security Policy must already contain a rule that allows connections via SSH.

1. Connect via command line using the default “admin" account
2. Navigate to expert mode
3. Backup the current /etc/ssh/sshd_config file

cp /etc/ssh/sshd_config /etc/ssh/sshd_config_original

4. Edit the current /etc/ssh/sshd_config file:

vi /etc/ssh/sshd_config

5. Below the sftp line

#Subsystem sftp /usr/libexec/openssh/sftp-server

Add:

Subsystem sftp internal-sftp

6. Save the changes and exit from vi editor.

7. Restart the SSHD daemon

/sbin/service sshd restart

8. Now you can connect with the gateway with an SFTP client using TCP port 22.

[G_W_Albrecht]

This is a real relevation for Mac OS users - now we can connect using Cyberduck instead of WinSCP !

Is this sftp server also available on Embedded GAiA units ?

[Alex_Lam1]

Thanks Danny.

That helps.

Wow R80.xx really changes a few stuffs 🙂 

[Denis_Spirin]

But what to do with permissions? Do you allow scpuser read access to /var/log? Do you create a specific folder, that belongs to scpuser? Manually setting permissions might be cumbersome.

[PhoneBoy]

Just to document this here, scponly users are no longer supported as of R82.10: https://support.checkpoint.com/results/sk/sk184280 

[Jan_Kleinhans]

and how to create such a user now?

[PhoneBoy]

As stated in the SK: Administrators can no longer restrict users to Secure Copy Protocol (SCP)-only access.

[Danny]

I updated my article for R82.10+ versions.
scponly users are still working well by recreating the /usr/bin/scponly shell with a tiny SFTP wrapper.

[PhoneBoy]

Pretty sure /etc/shells gets replaced on an upgrade...should probably confirm that. 🙂

[Danny]

That's perfectly fine, as it's ok for an upgrade to replace /etc/shells
As you can see in my first post, I wrote: "You can safely restore the original /etc/shells file after running the R80x Clish commands via: mv /etc/shells.orig /etc/shells".