creating a new user on Gaia via CLI - Revision history

Nighthawk at 19:59, 24 May 2016

2016-05-24T19:59:18Z

Nighthawk: /* set access */

2014-02-17T23:16:14Z

‎set access

Nighthawk at 23:14, 17 February 2014

2014-02-17T23:14:02Z

Nighthawk: /* switch to clish shell */

2014-01-30T19:18:37Z

‎switch to clish shell

Nighthawk at 19:18, 30 January 2014

2014-01-30T19:18:12Z

Nighthawk: /* set parameters */

2014-01-30T19:15:25Z

‎set parameters

Nighthawk: /* set uid to root */

2014-01-30T19:12:53Z

‎set uid to root

Nighthawk at 18:52, 16 December 2013

2013-12-16T18:52:29Z

Nighthawk at 18:12, 16 December 2013

2013-12-16T18:12:18Z

Nighthawk: Created page with "where jsmith should be replace with your username == add user == add user jsmith uid 1005 homedir /home/jsmith == set parameters == set user jsmith password == set rol..."

2013-12-16T18:11:57Z

Created page with "where jsmith should be replace with your username == add user == add user jsmith uid 1005 homedir /home/jsmith == set parameters == set user jsmith password == set rol..."

New page

where jsmith should be replace with your username

== add user ==
add user jsmith uid 1005 homedir /home/jsmith

== set parameters ==
set user jsmith password

== set roles ==
add rba user jsmith roles adminRole

== set access ==
add rba user jsmith access-mechanisms Web-UI,CLI

== set uid to root ==
set user jsmith uid 0

I don't like setting the user to the root UID. I think Check Point made a mess of the auth permissions as they have in the past. Without setting the root uid above, a user can't run fw commmands like "fw stat".

error:

/opt/CPshrd-R75.40/tmp/.CPprofile.sh: line 96: /opt/CPcvpn-R75.40/scripts/CVPNprofile.sh: Permission denied

[[category:gaia]]

@@ Line 1: / Line 1: @@
-where jsmith should be replace with your username
+==version==
@@ Line 12: / Line 13: @@
 == add user ==
   > add user jsmith uid 0 homedir /home/jsmith
 == set optional parameters ==

@@ Line 26: / Line 26: @@
-I don't like setting the user to the root UID.  I think Check Point made a mess of the auth permissions as they have in the past.  Without setting the root uid above, a user can't run fw commmands like "fw stat".
+I don't like setting the user to the root UID, but this is how you get an account with root access.  When adding via the web interfaces, it does the same thing.  I think Check Point made a mess of the auth permissions as they have in the past.  Without setting the root uid above, a user can't run fw commmands like "fw stat" and you get error upon login.
-error:
+example login error:
-−
   /opt/CPshrd-R75.40/tmp/.CPprofile.sh: line 96: /opt/CPcvpn-R75.40/scripts/CVPNprofile.sh: Permission denied

@@ Line 11: / Line 11: @@
 == add user ==
-  > add user jsmith uid 1005 homedir /home/jsmith
+  > add user jsmith uid 0 homedir /home/jsmith
 == set password ==
@@ Line 22: / Line 25: @@
   > add rba user jsmith access-mechanisms Web-UI,CLI
 I don't like setting the user to the root UID.  I think Check Point made a mess of the auth permissions as they have in the past.  Without setting the root uid above, a user can't run fw commmands like "fw stat".
@@ Line 34: / Line 35: @@
   -rwxrwx--- 1 admin bin 82 Apr  4  2012 /opt/CPcvpn-R75.40/scripts/CVPNprofile.sh
-I will investigate adding the users to the bin group.  Also, I will add them to the users group.  The users group needs to be added to /etc/ssh/sshd_config "AllowedGroups" line.  All check point allows there is the root group.  Go figure.  Sounds insecure to me.
+The users group needs to be added to /etc/ssh/sshd_config "AllowedGroups" line.  All check point allows there is the root group.  Go figure.  Sounds insecure to me.
 [[category:gaia]]

@@ Line 7: / Line 7: @@
   [Expert@myfirewall]# clish
   myfirewall>
 == add user ==

← Older revision		Revision as of 19:18, 30 January 2014
Line 1:		Line 1:
	where jsmith should be replace with your username		where jsmith should be replace with your username
		+
		+
		+	== switch to clish shell ==
		+	if you aren't here already or are at the expert prompt, just type...
		+
		+	[Expert@myfirewall]# clish
		+	myfirewall>

	== add user ==		== add user ==

@@ Line 4: / Line 4: @@
   > add user jsmith uid 1005 homedir /home/jsmith
-== set parameters ==
+== set password ==
   > set user jsmith password
-−
 == set roles ==
   > add rba user jsmith roles adminRole

← Older revision		Revision as of 19:12, 30 January 2014
Line 21:		Line 21:

	/opt/CPshrd-R75.40/tmp/.CPprofile.sh: line 96: /opt/CPcvpn-R75.40/scripts/CVPNprofile.sh: Permission denied		/opt/CPshrd-R75.40/tmp/.CPprofile.sh: line 96: /opt/CPcvpn-R75.40/scripts/CVPNprofile.sh: Permission denied
		+
		+	# ls -l /opt/CPcvpn-R75.40/scripts/CVPNprofile.sh
		+	-rwxrwx--- 1 admin bin 82 Apr 4 2012 /opt/CPcvpn-R75.40/scripts/CVPNprofile.sh
		+
		+	I will investigate adding the users to the bin group. Also, I will add them to the users group. The users group needs to be added to /etc/ssh/sshd_config "AllowedGroups" line. All check point allows there is the root group. Go figure. Sounds insecure to me.
		+



	[[category:gaia]]		[[category:gaia]]