fwm dbimport

Description Imports users into the Check Point User Database from an external file. You can create this file yourself, or use a file generated by fwm dbexport.

Syntax

> fwm dbimport [-m] [-s] [-v] [-r] [-k <errors>] [-f <file>] [-d <delim>]

Parameter	Description
-m	If an existing user is encountered in the import file, the user's default values will be replaced by the values in the template (the default template or the one given in the attribute list for that user in the import file), and the original values will be ignored.
-s	Suppress the warning messages issued when an existing user's values are changed by values in the import file.
-v	verbose mode
-r	fwm dbimport will delete all existing users in the database.
-k <errors>	Continue processing until nerror errors are encountered. The line count in the error messages starts from 1 including the attributes line and counting empty or commented out lines.
-f <file>	The name of the import file. The default import file is $FWDIR/conf/user_def_file.
-d <delim>	Specifies a delimiter different from the default value (;).

Comments The IKE pre shared secret does not work when exporting from one machine and importing to another.

To ensure that there is no dependency on the previous database values, use the‑r flag together with the -m flag.

File Format

The import file must conform to the following Usage:

• The first line in the file is an attribute list.
  • The attribute list can be any partial set of the following attribute set, as long as name is included:

{name; groups; destinations; sources; auth_method; fromhour; tohour; expiration_date; color; days; internal_password; SKEY_seed; SKEY_passwd; SKEY_gateway; template; comments; userc}

• The attributes must be separated by a delimiter character.
  • The default delimiter is the ; character. However, you can use a different character by specifying the -d option in the command line.
• The rest of the file contains lines specifying the values of the attributes per user. The values are separated by the same delimiter character used for the attribute list. An empty value for an attribute means use the default value.
• For attributes that contain a list of values (for example, days), enclose the values in curly braces, that is,{}. Values in a list must be separated by commas. If there is only one value in a list, the braces may be omitted. A + or - character appended to a value list means to add or delete the values in the list from the current default user values. Otherwise the default action is to replace the existing values.
• Legal values for the days attribute are: MON, TUE, WED, THU, FRI, SAT, SUN.
• Legal values for the authentication method are: Undefined, S/Key, SecurID, Unix Password, VPN‑1 & FireWall‑1 Password, RADIUS, Defender.
• Time format is hh:mm.
• Date format is dd-mmm-yy, where mmm is one of {Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec}.
• If the S/Key authentication method is used, all the other attributes regarding this method must be provided.
• If the Check Point password authentication method is used, a valid Check Point password should be given as well. The password should be encrypted with the C language encrypt function.
• Values regarding authentication methods other than the one specified are ignored.
• The userc field specifies the parameters of the user's SecuRemote connections, and has three parameters, as follows:
  • key encryption method - DES, CLEAR, Any
  • data encryption method - DES, CLEAR, Any
  • integrity method - MD5,[blank] = no data integrity.
  • "Any" means the best method available for the connection. This depends on the encryption methods available to both sides of the connection. For example,

    {DES,CLEAR,} means: key encryption method is DES; no data encryption; no data integrity.

• A line beginning with the ! character is considered a comment.