How to manage local users (SSH) in large environment

[Mark_Wheeler]

Hi

We have a large environment and we are looking for a better way to manage individual local SSH users. The goal would be to not always have to create a local user on every device when a new administrator joins the team. Until now there was a generic SSH user which was used by everyone. The future goal is that every administrator is using it's personalized SSH account.

We have ISE which is using RADIUS as well as TACACS+ but as far as i understand we still would need to create a user locally, hence this would mean either to manually create the users or to use something like Ansible to create local users automated on every Check Point device.

How are other large environments solve this problem?

Regards and thanks for any help,

Mark

[masher]

sk105542 and  sk72940 might answer your questions. I have a customer who uses RADIUS with a large number of users with different RBA configurations depending on their roles on the security team.

• https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
• https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Martin_Valenta]

we have around 400+ gateways, as part of build process we are adding all current users locally on gateway, if after some time somebody left or it's new member of team, we simply run script across all our gateway from MDS via CPRID tool in order to delete or add user.