creating a new user on secureplatform via CLI - Revision history

Nighthawk: /* version */

2016-05-24T19:57:02Z

‎version

2016-05-24T19:56:33Z

2014-04-05T17:29:23Z

2014-04-05T17:26:31Z

‎test new user account access

2014-04-05T17:22:03Z

‎creating the user account

2014-04-05T17:19:28Z

2014-04-05T17:18:17Z

‎test new user account access

2014-04-05T17:18:03Z

2014-04-05T17:13:48Z

2014-04-05T17:11:17Z

← Older revision		Revision as of 19:57, 24 May 2016
Line 1:		Line 1:
	==version==		==version==
−	~~R75.40~~

	The following instructions are performed using the admin account in expert mode. We will create a regular user account with restricted priveleges in cpshell. Full expert access will be gained by the user by entering expert mode. It is possible to have a regular user with a bash shell. The problem is Check Point makes a mess of standard linux system file and directory permissions, shell environments, ect... This makes creating such a user more work. That won't be covered here.		The following instructions are performed using the admin account in expert mode. We will create a regular user account with restricted priveleges in cpshell. Full expert access will be gained by the user by entering expert mode. It is possible to have a regular user with a bash shell. The problem is Check Point makes a mess of standard linux system file and directory permissions, shell environments, ect... This makes creating such a user more work. That won't be covered here.

← Older revision		Revision as of 19:56, 24 May 2016
Line 1:		Line 1:
		+	==version==
		+	R75.40
		+
	The following instructions are performed using the admin account in expert mode. We will create a regular user account with restricted priveleges in cpshell. Full expert access will be gained by the user by entering expert mode. It is possible to have a regular user with a bash shell. The problem is Check Point makes a mess of standard linux system file and directory permissions, shell environments, ect... This makes creating such a user more work. That won't be covered here.		The following instructions are performed using the admin account in expert mode. We will create a regular user account with restricted priveleges in cpshell. Full expert access will be gained by the user by entering expert mode. It is possible to have a regular user with a bash shell. The problem is Check Point makes a mess of standard linux system file and directory permissions, shell environments, ect... This makes creating such a user more work. That won't be covered here.

← Older revision		Revision as of 17:29, 5 April 2014
Line 1:		Line 1:
−	The following instructions are performed using the admin account in expert mode. We will create a regular user account with restricted priveleges in cpshell. Full expert access will be gained by the user by entering expert mode. It is possible to have a regular user with a bash shell. The problem is Check Point makes a mess of file and directory permissions, ~~mangles~~ shell environments, ect... This makes creating such a user more work. That won't be covered here.	+	The following instructions are performed using the admin account in expert mode. We will create a regular user account with restricted priveleges in cpshell. Full expert access will be gained by the user by entering expert mode. It is possible to have a regular user with a bash shell. The problem is Check Point makes a mess of standard linux system file and directory permissions, shell environments, ect... This makes creating such a user more work. That won't be covered here.

	== creating the user account ==		== creating the user account ==

@@ Line 23: / Line 23: @@
 == test new user account access ==
-Test the account by connecting to the SPLAT device via ssh. After a successful login, execute the "expert" command to gain full priveleges.
+Test the account by connecting to the SPLAT device via ssh. After a successful login, you will have be rescrited to commands available inside the cpshell environment.  Just type help at the prompt for list of available commands.  Run the "expert" command and enter the expert password to gain full priveleges in a bash shell environment.
 == troubleshooting ==

@@ Line 4: / Line 4: @@
 create user account with the standard linux useradd command...
-  [Expert@chkpfw]# useradd -d /home/jsmith -s /bin/cpshell -o -u 0 -G wheel -m jsmith
+  [Expert@chkpfw]# useradd -d /home/jsmith -s /bin/cpshell -o -u 0 -G root -m jsmith
 == set the user password ==

← Older revision		Revision as of 17:19, 5 April 2014
Line 1:		Line 1:
	The following instructions are performed using the admin account in expert mode. We will create a regular user account with restricted priveleges in cpshell. Full expert access will be gained by the user by entering expert mode. It is possible to have a regular user with a bash shell. The problem is Check Point makes a mess of file and directory permissions, mangles shell environments, ect... This makes creating such a user more work. That won't be covered here.		The following instructions are performed using the admin account in expert mode. We will create a regular user account with restricted priveleges in cpshell. Full expert access will be gained by the user by entering expert mode. It is possible to have a regular user with a bash shell. The problem is Check Point makes a mess of file and directory permissions, mangles shell environments, ect... This makes creating such a user more work. That won't be covered here.
−
−	~~== fix /etc/profile permissions ==~~
−	Check Point screws up the permissions on /etc/profile in SPLAT. In Gaia, it appears to be fixed. Regular users should have read access. Check /etc/profile permissions, if users don't have read access, set it with chmod.
−	~~[Expert@chkpfw1]# chmod 644 /etc/profile~~
−

	== creating the user account ==		== creating the user account ==

@@ Line 27: / Line 27: @@
   Enter new expert password:          <<< if you see this prompt you messed up!
-) edit /etc/passwd...set UID and GUID to zero and default shell to /bin/cpshell.  Failure to set the shell to cpshell will allow the user account root privileges immediately upon login.  This would not be secure.
+== test new user account access ==
-before editing
+== troubleshooting ==
- john:x:1002:1002::/home/admin:/bin/bash
-what is should look like after editing
+If login failures occur, examine /var/log/secure and /var/log/auth files for error messages.
- john:x:0:0::/home/admin:/bin/cpshell
 [[category:sysadmin]]

@@ Line 8: / Line 8: @@
 == creating the user account ==
-) create user account with the standard linux useradd command...
+create user account with the standard linux useradd command...
   [Expert@chkpfw]# useradd -d /home/jsmith -s /bin/cpshell -o -u 0 -G wheel -m jsmith
-) set the user password
   [Expert@chkpfw]# /usr/bin/passwd jsmith
   New UNIX password: