- Products
- Learn
- Local User Groups
- Partners
- More
CheckMates Fifth Birthday
Celebrate with Us!
days
hours
minutes
seconds
Join the CHECKMATES Everywhere Competition
Submit your picture to win!
Check Point Proactive support
Free trial available for 90 Days!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
The 2022 MITRE Engenuity ATT&CK®
Evaluations Results Are In!
Now Available: SmartAwareness Security Training
Training Built to Educate and Engage
MITRE ATT&CK
Inside Check Point products!
CheckFlix!
All Videos In One Space
Hi Mates,
I am using 2 x CheckPoint 5600 Firewall in my workplace.
We are requested by our Internal Audit that we need to export and review the Firewall configuration periodically.
I am the only person here who hold the Firewall Administrator password, and I am not allow to share out the admin pwd.
Can anyone guide me on how to create a READ ONLY account that can export the FireWall Configuration file?
thank you very much.
---david
Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.
This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.
It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data.
You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.
What kind of export? MGMT database? OS settings? Please elaborate
Only the OS settings. thank you.
You need to set up a new OS account and assign it to monitorOnly role
Read the Gaia admin guide for more details.https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Gaia_AdminGuide/Content/Topi...
Hi _Val_, The two READ ONLY accounts that i mentioned were exactly in the MonitorRole. But they seem do not have the privilege to export the configuration nor ssh-in. thanks. --david
Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.
This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.
It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data.
You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.
thank you!
you are welcome
according to some experts they mention something adding a RULE to allow these READ ONLY accounts to access SSH and the WEB interface that can serve the same purpose. Can you please guide me through how to set this rule(s)? Many Many thanks. --david
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY