Creating users via script/using CPDIR on SMB Devices

[SaffaRamma]

I know it is possible to execute commands from a management server (SMS) to a centrally managed SMB via CPDIR. For example, the below command works a treat (PS - 10.20.30.40 is not an actual IP I'm using):

$CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /bin/clish -c "show configuration"

What does seem to be an issue however is the ability to add local administrators this way (I have tried multiple iterations of the below)?

$CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /bin/clish -c "add user newadmin type admin password this_is_my_real_password permission RW"
Unexpected error: attempt to index global 'cgilua' (a nil value)

$CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /bin/clish -c "add administrator username newadmin password-hash $1$UHVNJb2O$1UXMqCZm9767DZNtoIqYv. permission read-write"
Could not set administrator password-hash: Not valid password hash
Could not set administrator password-hash: Not valid password hash

$CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /bin/clish -c "add administrator username newadmin password-hash '$1$UHVNJb2O$1UXMqCZm9767DZNtoIqYv.' permission read-write"
Could not set administrator password-hash: Not valid password hash
Could not set administrator password-hash: Not valid password hash

The above commands within the quotation marks work fine locally on the SMB device, but running the CPRID commands from the SMS fail with the errors in bold above.

[PhoneBoy]

Yes, it should be supported.
That said, the canonical path to clish on SMB appliances is /pfrm2.0/bin/clish
If that still doesn't work, recommend a TAC case.

[SaffaRamma]

Thanks for the quick response! Tried the change in canonical path ($CPDIR/bin/cprid_util -server 10.20.30.40 -verbose rexec -rcmd /pfrm2.0/bin/clish -c "add user testuser type admin password testuser123password permission R") and still no dice! I'll get a ticket raised with TAC.

[Bärbel]

Was this solved by TAC? I'm also getting "Unexpected error: attempt to index global 'cgilua' (a nil value)" when trying to do something like this:

cprid_util -server 1.2.3.4 -verbose rexec -rcmd clish -c "set administrator session-settings inactivity-timeout 15"

[G_W_Albrecht]

Seems that some commands will not work, as found in sk106490: How to remotely reset Admin / Expert password on a Security Gateway:

This procedure is NOT supported for Gaia Embedded appliances. If you attempt to run this command on a Gaia Embedded appliance, you will receive the following error: "Unexpected error: attempt to index global 'cgilua' (a nil value)"

There is also a procedure using different syntax to achieve the same on SMBs:

sk106025 - How to reset the Expert mode password on a Quantum Spark Appliance with Gaia Embedded OS

You could try to use a script on SMB, first lines:

#!/bin/bash -f
source /fwtmp/opt/fw1/tmp/.CPprofile.s

 and call it with the needed parameter values using cprid_util command.

[Hugo_vd_Kooij]

Nice try. But then you get a lua error. so that doesn't work either.

[nmelay2 · Accepted solution]

Well, it seems like some Lua code in clish is trying to access the USER environment variable while it's not been set by CPRID, hence the nil value error.

You need to set it first:

cprid_util -server <ip> -verbose putenv -attr USER -val admin
cprid_util -server <ip> -verbose rexec -rcmd clish -c 'set administrator username <adminuser> password-hash "<hash>" permission read-write'

The putenv command should remain in effect until the gateway is rebooted.