- Products
- Learn
- Local User Groups
- Partners
- More
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
Join our TechTalk: Malware 2021 to Present Day
Building a Preventative Cyber Program
Be a CloudMate!
Check out our cloud security exclusive space!
Check Point's Cyber Park is Now Open
Let the Games Begin!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
While reviewing Check Point installations I often encounter setups where the shell of the admin user account was changed to /bin/bash in order to allow copying documents via scp to and from Check Point Gaia systems.
This is because the scponly shell isn't known.
Follow these steps to create an scpuser for copying documents securely without compromising your admin account.
[ R77.30 ]
add user scpuser uid 2600 homedir /home/scpuser
set user scpuser shell /usr/bin/scponly
set user scpuser password
save config
[ R80.x ]
add user scpuser uid 2600 homedir /home/scpuser
set user scpuser realname Scpuser
add rba role scpRole domain-type System readwrite-features expert
add rba user scpuser roles scpRole
set user scpuser gid 100 shell /usr/bin/scponly
set user scpuser password
save config
Good tip, but I'm going to move it to the https://community.checkpoint.com/community/infinity-general/appliances-and-gaia?sr=search&searchId=1... forum
Indeed it is very good tip, however you have to tweak little bit group permissions I believe... The reason is that if you create a capture with tcpdump (with admin user) and then try to download it via scp (using scpuser) you will not be allowed. I have faced something similar recently.
I've adopted an old-school approach to the inability to read/write. When creating the home directory for the scp user, I make sure to `chmod g+s` that directory. This causes all subsequent files created there to be created with the group assigned to the directory rather than the group of the creating user. Then when a tcpdump or similar is created, I specify the scp user's home directory as the path for the file.
Similarly, I only scp to the scp user's home directory and then move files around with the expert user.
Enabling SFTP
This alternative example describes how to enable SFTP access on a Security Gateway using the default “admin” account. Note: a Security Policy must already contain a rule that allows connections via SSH.
1. Connect via command line using the default “admin" account
2. Navigate to expert mode
3. Backup the current /etc/ssh/sshd_config file
cp /etc/ssh/sshd_config /etc/ssh/sshd_config_original
4. Edit the current /etc/ssh/sshd_config file:
vi /etc/ssh/sshd_config
5. Below the sftp line
#Subsystem sftp /usr/libexec/openssh/sftp-server
Add:
Subsystem sftp internal-sftp
6. Save the changes and exit from vi editor.
7. Restart the SSHD daemon
/sbin/service sshd restart
8. Now you can connect with the gateway with an SFTP client using TCP port 22.
This is a real relevation for Mac OS users - now we can connect using Cyberduck instead of WinSCP !
Is this sftp server also available on Embedded GAiA units ?
Thanks Danny.
That helps.
Wow R80.xx really changes a few stuffs 🙂
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY