Change Expert Password For many FW

[Christian_Garci]

Hi Mates,

It is possible to change the expert password for many FW at the same time?

We have many FW managed for a Server Magament R 77.30 and we need to change the expert password for about 30 FW 1430.

Thanks

[Danny]

Solution 1

Create a little Bash script that executes the following command for every gateway and run on your firewall management:

$CPDIR/bin/cprid_util -server <IP_address_of_Security_Gateway> -verbose rexec -rcmd /bin/clish -s -c 'set expert password-hash NEW_HASH>'‍

Solution 2

Use an expect script on your firewall management to login to all your appliances and change the expert password. Example:

#!/usr/bin/expectset HOST     "192.168.10.1"set LOGIN    "admin"set PASSWORD "password"set COMMAND  "set expert password-hash NEW_HASH"set timeout  60spawn ssh -C -x -l $LOGIN $HOSTexpect { "fingerprint" {    send "yes\n"    expect "word: $"    send "$PASSWORD\n"    } "word: $" {    send "$PASSWORD\n"    }}expect ">"send "$COMMAND\n"expect ">"send "save config\n"expect ">"send "exit\n"‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[Tomer_Sole]

anything that is available in cprid is also available using the "run script" Management API command.

run script command: Check Point - Management API reference 

So either using the mgmt_cli executable on the Management server, or from the command-line inside SmartConsole GUI, or using REST calls with your favorite scripting language, should be something like:

run-script script-name "changing expert password" script "set expert password-hash NEW_HASH" targets.1 "corporate-gateway" targets.2 "branchOfficeGW" 

Please note that run-script returns a task, and that task should be polled to see whether it succeeded or failed using the show tasks command: Check Point - Management API reference 

[Danny]

FYI: For the 30x 1430 SMB Appliances that this thread was opened for there is a limitation when trying to execute scripts directly from within the GUI.

[Tomer_Sole]

I didn't notice the appliance, sorry.. I suppose the API / command-line option would not work in this case either because it calls the same cprid wrapper, even though this is possible with cprid.