set expert password-hash using autoconf.clish doesnt' work

[Antonio_Martins]

HI CheckMates,

I'm trying to configure expert password using set expert password-hash in autoconf.clish but it doesn't work. I.e the command is accepted but expert password doesn't work.

Strangely user admin password, that was configured the same way (using set administrator username admin password-hash in autoconf.clish) works fine!

Hash obtained either using "cryptpw -a md5 <password>” or ‘openssl passwd -1”,

What am I doing wrong?

AM

[funkylicious]

Hi,

You can generate the MD5 has from /sbin/grub-md5-crypt , then copy the saltedhash and do a set expert-password-hash <hash> .

Should work just fine like this.

[Antonio_Martins]

Hi,

Same result. Admin password hash works fine, expert password hash doesn't:

GW000 login: admin
Password:
GW000> expert
Enter expert password:
Wrong password, exiting.

By the way, I'm testing in 1200R gateway.

[PhoneBoy]

I have a feeling the dollar signs in the password hash are getting interpreted by the shell.
Enclose the hashed string in single quotes.

[HristoGrigorov]

sk119633 may help with this

[Antonio_Martins]

The way I found to set expert password-hash using autoconf.clish was to set the password in clish and then copy the value from /flash/expert_pass_ to file.

I guess the hashing algorithm for expert password is not MD5 as it is with admin password hashes.

[Antonio_Martins]

Enclose the hashed string in single quotes didn't solved it.

[G_W_Albrecht]

R77.20.87 CLI Guide:

set expert password

Description

Sets the initial password or password hash for the expert shell

Syntax

set expert {password|password-hash} {<pass>|<pass_hash>}

Parameters

Parameter	Description
pass	Password using alphanumeric and special characters
pass_hash	Password MD5 string representation

Example

set expert password-hash $1$fGT7pGX6$oo9LUBJTkLOGKLhjRQ2rw1

Output

Success shows OK. Failure shows an appropriate error message.

Comments

To generate a password-hash, you can use this command on any Check Point SMB Appliance gateway (as an expert user).

cryptpw –a md5 <password string>

If this works on CLI only it would be an autoconf.clish limitation - you could even involve TAC !

[Antonio_Martins]

Example.

[Expert@GW000]# cryptpw -a md5 ClearPassw0rd
$1$byBwFTca$iOzMEY5EfDZ/deRgXaXKi1
[Expert@GW000]# exit

...

Gateway-ID-7F99045E> set expert password-hash $1$byBwFTca$iOzMEY5EfDZ/deRgXaXKi1
Setting expert password with hash
OK
Gateway-ID-7F99045E> expert
Enter expert password:
Wrong password, exiting.

Anyone else with the same issue?

[G_W_Albrecht]

You should involve TAC, this sounds like incorrect behaviour !

[TJ_Aus]

Very old thread I know, however I had a need to change the expert password on a number of 1500 series Quantum Spark firewalls running the recommended R81.10.17 firmware with the Digicert patch
So, to do it from a script you need to work out the hash first.  The following works in the scenario provided above but note the command is slightly different:

In expert mode on a 1500 where the new password is "NewPassword":
#cryptpw NewPassword -m md5
$1$EV4ZvIAH$1sNhoXVHRjznDvV9nOB7G/

Then go to clish on the 1500:
set expert password-hash $1$EV4ZvIAH$1sNhoXVHRjznDvV9nOB7G/

Then use the above command to script the change of expert password on all the other 1500s as desired Always test it first

[G_W_Albrecht]

The slightly different command makes no difference at all, so your post is just superfluous:

- if you just use #cryptpw NewPassword md5 will be always used by default

- to use -m or -a makes no difference at all and is not needed if you want md5 be used

[TJ_Aus]

Yes, I was referring to the cryptpw command . The -a doesn't work in case someone tries and yes, the command you just posted works.

[G_W_Albrecht]

You mean -a does not work in scripts, but -m does ? You did not write that...

Syntax in CLI is:

BusyBox v1.36.1 (2024-03-18 18:58:40 IST) multi-call binary.
Usage: cryptpw [-P FD] [-m TYPE] [-S SALT] [PASSWORD] [SALT]
Print crypt(3) hashed PASSWORD
-P N Read password from fd N
-m TYPE des,md5,sha256/512 (default )
-S SALT   

But -a (old syntax afaik) does work in CLI, and default is md5. 

[TJ_Aus]

Correct, -a doesn't work. -m works but isn't needed as you pointed out, just md5 is required plus the password

[G_W_Albrecht]

No, md5 is not required as it is the default, so cryptpw password will be sufficient. cryptpw -m sha512 password will give a hash starting with $6 denoting sha-512. I see no script used in your post, and in expert mode on a 1500 -a SHA512 will work. I have tested the following script on a 1600:

#!/bin/sh
cryptpw -a sha512 karin

 Output is:

[Expert@sweet-sixteen]# ./test.sh
$6$WUar.r5CXaB6JlQj$aNrkcJXFfP/esvcQB4GkF0XgOZMLf0Rr3WHwR57aAFG/ZMCUwr37HzAGE4iSPusQFRtCzRir4ZLlW8oiwhVd41

No error using -a ! So i see no use in your post...

[TJ_Aus]

Thanks for your kind reply, it is very helpful as I didn't know -a or -m weren't needed and that MD5 was default as it looked like SHA was the default from the command output
My point was that in an earlier post, -a was used which doesn't work for me. See the output. I don't get an error, I just get the help. I was looking to script it, but it didn't work when I typed it manually. I later found -m worked and didn't investigate further as I got what I needed

Yes we don't need to use -m md5 but -m md5 works if it is used regardless if it is needed or not. The command works if I use -m or if I don't use -m. See below:

# cryptpw –a md5 NewPassword
BusyBox v1.36.1 (2024-03-18 18:58:40 IST) multi-call binary.

Usage: cryptpw [-P FD] [-m TYPE] [-S SALT] [PASSWORD] [SALT]

Print crypt(3) hashed PASSWORD

-P N Read password from fd N
-m TYPE des,md5,sha256/512 (default )
-S SALT

# cryptpw -m md5 NewPassword
$1$pztzUpMk$wCHZ57cZzc6p1lpDKJ/TR0
# cryptpw NewPassword
$1$OWyL25XG$uw3.N0yi1el.tPLXS.M6P/
# fw ver
This is Check Point's 1570 Appliance R81.10.17 - Build 654

[G_W_Albrecht]

Very strange ! Both my SMBs accept -a - maybe that option was removed in .17 - but is still present in R82.00.00 ?

The last test above was from a 1600 Appliance

My other testing device gives:

[Expert@fifteenfifty]# fw ver

This is Check Point's 1550 Appliance R81.10.15 - Build 913

[Expert@fifteenfifty]# cryptpw -a md5 karin

$1$KBNQMt5v$OdQeEqdBdT7MTSJ27MiqH.

[TJ_Aus]

Roger that, mine is on a different release and is a 1570

[G_W_Albrecht]

1550 or 1570 makes no difference in BusyBox commands, but the release / build will.