Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Danny
Champion Champion
Champion

HowTo - Creating an scpuser account on Gaia Clish

While reviewing Check Point installations I often encounter setups where the shell of the admin user account was changed to /bin/bash in order to allow copying documents via scp to and from Check Point Gaia systems.

This is because the scponly shell isn't known.

Follow these steps to create an scpuser for copying documents securely without compromising your admin account.

[ R77.30 ]

add user scpuser uid 2600 homedir /home/scpuser
set user scpuser shell /usr/bin/scponly
set user scpuser password
save config‍‍‍‍‍‍‍‍

[ R80.x ]

add user scpuser uid 2600 homedir /home/scpuser
set user scpuser realname Scpuser
add rba role scpRole domain-type System readwrite-features expert
add rba user scpuser roles scpRole
set user scpuser gid 100 shell /usr/bin/scponly
set user scpuser password
save config‍‍‍‍‍‍‍‍‍‍‍‍‍‍
(2)
7 Replies
PhoneBoy
Admin
Admin

0 Kudos
Astardzhiev
Contributor

Indeed it is very good tip, however you have to tweak little bit group permissions I believe... The reason is that if you create a capture with tcpdump (with admin user) and then try to download it via scp (using scpuser) you will not be allowed. I have faced something similar recently.

Quinn_Yost
Contributor

I've adopted an old-school approach to the inability to read/write.  When creating the home directory for the scp user, I make sure to `chmod g+s` that directory.   This causes all subsequent files created there to be created with the group assigned to the directory rather than the group of the creating user.  Then when a tcpdump or similar is created, I specify the scp user's home directory as the path for the file.

Similarly, I only scp to the scp user's home directory and then move files around with the expert user.

Markusevc
Employee
Employee

Enabling SFTP

This alternative example describes how to enable SFTP access on a Security Gateway using the default “admin” account. Note: a Security Policy must already contain a rule that allows connections via SSH.


1. Connect via command line using the default “admin" account
2. Navigate to expert mode
3. Backup the current /etc/ssh/sshd_config file

cp /etc/ssh/sshd_config /etc/ssh/sshd_config_original

4. Edit the current /etc/ssh/sshd_config file:

vi /etc/ssh/sshd_config


5. Below the sftp line

#Subsystem sftp /usr/libexec/openssh/sftp-server

Add:

Subsystem sftp internal-sftp


6. Save the changes and exit from vi editor.

7. Restart the SSHD daemon

/sbin/service sshd restart


8. Now you can connect with the gateway with an SFTP client using TCP port 22.

Security Solutions Expert for Global Strategic Partners GSI/MSP/Telco & Consultancy Firms
G_W_Albrecht
Legend
Legend

This is a real relevation for Mac OS users - now we can connect using Cyberduck instead of WinSCP !

Is this sftp server also available on Embedded GAiA units ?

CCSE CCTE CCSM SMB Specialist
0 Kudos
Alex_Lam1
Contributor

Thanks Danny.

That helps.

Wow R80.xx really changes a few stuffs 🙂 

 

0 Kudos
Denis_Spirin
Explorer

But what to do with permissions? Do you allow scpuser read access to /var/log? Do you create a specific folder, that belongs to scpuser? Manually setting permissions might be cumbersome.
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events