Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Johannes_Bachma
Participant
Jump to solution

Activate bashUser via script on a Embedded Gaia device?

Hi,

it is possible to activate the bashUser via script on a Embedded Gaia device?

I want to execute the following command in expert mode "bashUser on" via a bat-script from a Windows client.

I tried it with the tool "plink". With this tool, I'm able to login and execute several commands in the clish. But I have to be in expert mode to execute the "bashUser on" command.

But I have problems after using "expert" to provide the expert-password via the script.

On a normal Gaia appliance I can use the following (but on Embedded Gaia there is not set command for the shell):

C:\ScriptingTest\plink.exe -ssh admin@192.168.0.1 -pw vpn123 set user admin shell /bin/bash

Any idea how I can solve this?

Best regards,

Johannes

2 Solutions

Accepted Solutions
G_W_Albrecht
Legend
Legend

My collegue found the correct syntax needed to achieve this on centrally managed SMBs:

$CPDIR/bin/cprid_util -server <IP of SMB> -verbose rexec -rcmd /bin/bash -c "LOGNAME=admin bashUser on"
user: admin

Bash login enabled.
Scp access enabled.

Note:
        Your default shell will now be bash,
        and when you login you will enter expert mode.
        We recommend that you use clish as your default shell,
        and move to expert mode only when necessary.
        You can move from bash to clish using the "clish" command.
        To restore your default shell to clish run "bashUser off"

Seems that the environment variable LOGNAME is not set in Embedded GAiA...

CCSE CCTE CCSM SMB Specialist

View solution in original post

G_W_Albrecht
Legend
Legend

As a follow-up you can find here the relevant SKs:

sk119633 How to remotely reset Admin password on Centrally Managed 1100 / 1200R / 1400 appliance fro...

and the original cprid_util SK:

sk101047 How to manage Security Gateway using the "cprid_util" tool

I also did some testing and have found that the LOGNAME seems only to be needed by bashUser - other commands will work the same without it:

# $CPDIR/bin/cprid_util -server 172.x.x.x -verbose rexec -rcmd /bin/bash -c "free"
              total         used         free       shared      buffers
  Mem:       983408       831912       151496            0        25120
 Swap:            0            0            0
Total:       983408       831912       151496

# $CPDIR/bin/cprid_util -server 172.x.x.x -verbose rexec -rcmd /bin/bash -c "fw ver -k"
This is Check Point's 1200R Appliance R77.20.75 - Build 286
kernel: R77.20.75 - Build 256

# $CPDIR/bin/cprid_util -server 172.28.8.177 -verbose rexec -rcmd /bin/clish -c "show diag"
Current system info
-----------------------------------
Image name: R77_990172286_20_75
Image version: 286
Bootloader version: 990170212
HW MAC Address: 00:1C:7F:
LAN MAC Address: 00:1C:7F:
DMZ MAC Address: 00:1C:7F:
Unit version: 1
Unit model: L61i
Marketing capabilities: 0
Marketing name: <Undefined>
ODM Hardware Revision: <Undefined>
Management opaque: Kb2XMJTTeWk=:xaYS3i++sLw=:zRlzLIL82ek=
Hardware capabilities: 1 - SD card
RTC status: OK
eMMC Initial bad blocks: 0
eMMC Current bad blocks: 0
eMMC Spare blocks: 118
HW monitor file system not found

CCSE CCTE CCSM SMB Specialist

View solution in original post

11 Replies
G_W_Albrecht
Legend
Legend

I fear that a script on a Win PC will not do - e.g. SSH will execute the given command in the default shell only, but you can see how this works from a CP SMS here: Reset Expert Password on an 1100

To activate bashUser, this would be:

$CPDIR/bin/cprid_util -server <IP of SMB> -verbose rexec -rcmd /bin/bash -c "bashUser on"

CCSE CCTE CCSM SMB Specialist
Johannes_Bachma
Participant

Hi Günther,

thanks for your answer.

I tried it today with the cprid_util command you provided, also slightly different variations. But sadly non of them worked.

I got a "Current user cannot be determined" when using the command above.

I was only able to use cprid_util for clish commands like "show clock" for example when using:

$CPDIR/bin/cprid_util -server <IP of SMB> -verbose rexec -rcmd /bin/clish -c "show clock"

The appliances are managed via SmartProvisioing, I think that will not cause any problems here, since clish commands will work.But everytime I tried it with /bin/bash I got an error.

Best regards,

Johannes

0 Kudos
G_W_Albrecht
Legend
Legend

Very strange - i tested it again now, and on the first time, it worked, but any other try would give Current user cannot be determined.

CCSE CCTE CCSM SMB Specialist
0 Kudos
G_W_Albrecht
Legend
Legend

Very interesting - it works without issues on a locally managed 730, but only worked once on the 1200R.

CCSE CCTE CCSM SMB Specialist
0 Kudos
G_W_Albrecht
Legend
Legend

No, it does not Smiley Sad - i did some tests together with our Linux Guru and found that the error only shows on centrally managed SMBs, but the command is not executed in both cases!

Reason:

- This command is only working when SIC has been established --> so locally managed SMBs are not supported.

- Embedded GAiA seems to be different, so it also does not work as it is on SMBs with existing SIC, but at least gives an error message...

CCSE CCTE CCSM SMB Specialist
0 Kudos
G_W_Albrecht
Legend
Legend

My collegue found the correct syntax needed to achieve this on centrally managed SMBs:

$CPDIR/bin/cprid_util -server <IP of SMB> -verbose rexec -rcmd /bin/bash -c "LOGNAME=admin bashUser on"
user: admin

Bash login enabled.
Scp access enabled.

Note:
        Your default shell will now be bash,
        and when you login you will enter expert mode.
        We recommend that you use clish as your default shell,
        and move to expert mode only when necessary.
        You can move from bash to clish using the "clish" command.
        To restore your default shell to clish run "bashUser off"

Seems that the environment variable LOGNAME is not set in Embedded GAiA...

CCSE CCTE CCSM SMB Specialist
Johannes_Bachma
Participant

Thank you very much for your troubleshooting and testing. I really appreciate this.

I will try this command the next days Smiley Happy

G_W_Albrecht
Legend
Legend

Good Luck Smiley Happy ! Please mark it as correct answer if it does also work for you.

CCSE CCTE CCSM SMB Specialist
Johannes_Bachma
Participant

The command also worked on my side. Thanks again Günther. This will help me a lot Smiley Happy

0 Kudos
PhoneBoy
Admin
Admin

I tested it with my SMB appliances and it seems to work, so marking as correct Smiley Happy

0 Kudos
G_W_Albrecht
Legend
Legend

As a follow-up you can find here the relevant SKs:

sk119633 How to remotely reset Admin password on Centrally Managed 1100 / 1200R / 1400 appliance fro...

and the original cprid_util SK:

sk101047 How to manage Security Gateway using the "cprid_util" tool

I also did some testing and have found that the LOGNAME seems only to be needed by bashUser - other commands will work the same without it:

# $CPDIR/bin/cprid_util -server 172.x.x.x -verbose rexec -rcmd /bin/bash -c "free"
              total         used         free       shared      buffers
  Mem:       983408       831912       151496            0        25120
 Swap:            0            0            0
Total:       983408       831912       151496

# $CPDIR/bin/cprid_util -server 172.x.x.x -verbose rexec -rcmd /bin/bash -c "fw ver -k"
This is Check Point's 1200R Appliance R77.20.75 - Build 286
kernel: R77.20.75 - Build 256

# $CPDIR/bin/cprid_util -server 172.28.8.177 -verbose rexec -rcmd /bin/clish -c "show diag"
Current system info
-----------------------------------
Image name: R77_990172286_20_75
Image version: 286
Bootloader version: 990170212
HW MAC Address: 00:1C:7F:
LAN MAC Address: 00:1C:7F:
DMZ MAC Address: 00:1C:7F:
Unit version: 1
Unit model: L61i
Marketing capabilities: 0
Marketing name: <Undefined>
ODM Hardware Revision: <Undefined>
Management opaque: Kb2XMJTTeWk=:xaYS3i++sLw=:zRlzLIL82ek=
Hardware capabilities: 1 - SD card
RTC status: OK
eMMC Initial bad blocks: 0
eMMC Current bad blocks: 0
eMMC Spare blocks: 118
HW monitor file system not found

CCSE CCTE CCSM SMB Specialist

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events