Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
HeikoAnkenbrand
Champion
Champion

Show Ruleset and Objects on the Gateway (Emergency Recovery)

I had an emergency case at the customer that the management server (virtual server under VMWARE) was encrypted by an encryption trojan. The VMWare datastore was encrypted and also the virtual management server. Thus, the management server became unusable. Unfortunately, there was no backup, snapshot or "mirate server export" of the management server.

The big question was, can we reconstruct the policy and the corresponding objects on the gateway.

I found an interesting way to show the currently running policy and objects on the gateway.

Show layer structure:

 

db_tool -p /opt/CPsuite-R81.10/fw1/state/local/FW1 get_layers

 

Show  installed ruleset:

 

db_tool -p /opt/CPsuite-R81.10/fw1/state/local/FW1 get_rules

 

Show all installed objects and object settings:

 

db_tool -p /opt/CPsuite-R81.10/fw1/state/local/FW1 get_rules |grep UUID | awk '{split($0,a,":"); print a[2]}' | uniq | awk ' { cmd="db_tool -p /opt/CPsuite-R81.10/fw1/state/local/FW1 get_object -u "$1;system(cmd)}'

 

Show IP spoofing settings:

 

ifconfig -a |grep -B 1 inet |grep encap| awk '{print $1}' | grep -v lo | grep -v ":" | grep -v ^lo | xargs -I % sh -c 'echo %;echo -n " VIP "; cphaprob -a if |grep %|grep -v U|grep -v D | cut -c16-| tr -d "\r\n" ;echo;echo -n " IP ";ifconfig % | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1;echo -n " Mask " ;ifconfig % | sed -rn "2s/ .*:(.*)$/\1/p";echo -en " ANTISPOOFING ENABLED:\t";more $FWDIR/state/local/FW1/local.set |grep -A 30 % | grep has_addr_info | cut -c17- | tr \) " " |sort -n| uniq ; echo -en " ANTISPOOFING MODE:\t"; if [ `more $FWDIR/state/local/FW1/local.set |grep -A 30 % | grep monitor_only | cut -c16- | tr \) " " |sort -n| uniq| grep -o false` ]; then echo "PREVENT"; else echo "DETECT"; fi; echo -en " ANTISPOOFING TOPO:\t"; if [ `more $FWDIR/state/local/FW1/local.set |grep -A 30 % | grep external | cut -c12- | tr \) " " |sort -n| uniq| grep -o true` ]; then echo "External"; else echo "Internal"; fi;echo " ADDRESS SPOOFING NETWORKS:";more $FWDIR/state/local/FW1/local.set | grep -A 30 %|grep ": (\""|sort -n| uniq |tr \(\)\<\>\:\" \ ;echo " "'

 

PS:

I am working on a script that will automatically generate the appropriate policy and objects in management CLI (mgmt_cli) format. Thus, the policy can be imported to the management server very quickly.

Give me a little more time for this script.

The big question is, does Check Point already have a script for this case?


➜ CCSM Elite, CCME, CCTE
(1)
10 Replies
Danny
Champion
Champion

Repost plus some additions of what @deniskr posted 2 weeks ago here.

TAC / PS have developed a CP-internal method to recover the security policy from a gateway. Ask them for help in such cases.

0 Kudos
_Val_
Admin
Admin

Heiko, could you elaborate about "encrypted by a trojan"? Was it a VM, and the VM server got encrypted? I hardly believe a trojan could do anything on the HW-based Gaia server in the first place...

0 Kudos
HeikoAnkenbrand
Champion
Champion

YES, the encryption trojan has encrypted the complete VMWare datastore. This meant that all virtual machines could no longer be used. The management server was also affected because it was also virtual system.

I have corrected this in the text above


➜ CCSM Elite, CCME, CCTE
_Val_
Admin
Admin

Understood, thanks for clarifying.

0 Kudos
CheckPointerXL
Advisor

Hi all,

i've a similar problem. The management server got corrupted after a VMware upgrade and no backup/snapshot.

I can access gaia system but it seems that a ton of linux commands and clish shell are corrupted too (unable to use).

So i was thinking about two fix:

- Try to extract the database from the OS to a new deployed management to test a migrate server (this command it doesn't work on corrupted VM). Anyone is able to identify in which folder/partition the database it is located?

- Try to fix the corrupted system: no access to clish so i cannot perform, for example, a software upgrade... any idea?

0 Kudos
the_rock
Legend
Legend

Im pretty sure below is all database related on mgmt server

$CPDIR/database folder

Andy

 

[Expert@QUANTUM-MANAGEMENT:0]# cd /opt/CPshrd-R81.20/database/
[Expert@QUANTUM-MANAGEMENT:0]# ls
CPCoreUploader
EntMgr_BC_DB.xml
EntMgr_DB.xml
EntMgr_DB.xml.org
ICA_QUANTUM-MANAGEMENT_a2n_net_uhsukv_ac03fe.crl
cpdiag
cpeps
cpeps_verification
cprid
downloads
entitlement_status_collector_db.C
entitlement_status_collector_db.C.backup
fingerprints.txt
postgresql
[Expert@QUANTUM-MANAGEMENT:0]#

CheckPointerXL
Advisor

i will try to move that folder on a new mgmt and to test a migrate server on it

thanks !

the_rock
Legend
Legend

Also, attached a file that describes a process building new mgmt from scratch (old school method). Never tried in R80+, but I bet it still works.

Andy

0 Kudos
_Val_
Admin
Admin

No, it will not. The procedure is incomplete, and only works for R7x and below. 

the_rock
Legend
Legend

Good to know!

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events