Managing User Accounts in Gaia Clish

Notes:

You must run these commands in Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group. of the applicable Security Group A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected..
You can use the "add user" command to add new users, but you must use the "set user <username> password" command to set the password and allow the user to log on to the system.

Syntax

To modify a user account

set user <UserName>

force-password-change {yes | no}

gid <System Group ID>

homedir <Path>

lock-out off

newpass <Password>

password

password-hash <Password Hash>

realname <Name>

shell <Login Shell>

uid <User ID>

Note - For the default users admin and monitor, you can only change the Shell and Roles.

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently.

Parameters

CLI Parameters

Parameter

Description

user <UserName>

Configures unique login username - an alphanumeric string, from 1 to 32 characters long, that can contain dashes (-) and underscores (_), but not spaces.

uid <User ID>

Optional. Configures unique User ID to identify permissions of the user:

0 for administrator users and RADIUS user account (this is the default option)

An integer between 103 and 65533 for non-administrator user

Note - If a value is not specified, Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. OS automatically assigns the next free sequential number.

homedir <Path>

Configures user's home directory.

This is the full Linux path name of a directory, to which the user will log in.

Must be a sub-directory of /home/ directory.

If the sub-directory does not already exist, it is created.

force-password-change {yes | no}

If you wish to force the user to change the configured password during the next login, set the value to yes.

Note - If the user does not log in within the time limit configured by the "set password-controls expiration-lockout-days" command, the user may not be able to log in at all.

gid <System Group ID>

Configures System Group ID (0‑65535) for the primary group, to which a user belongs.

The default is 100.

You can add the user to several groups.

Use the "add group" and "set group" commands to manage the groups.

lock-out off

Unlocks the user, if the user was locked-out.

The password expiration date is adjusted, if necessary.

newpass <Password>

Configures a new password for the user.

Gaia does not ask to verify the new password.

The password you enter shows on the terminal command line in plain text, and is stored in the command history as plain text.

password

Configures a password for the new user.

The command runs in interactive mode.

You must enter the password twice, to verify it.

The password you enter is not visible on the terminal command line.

password-hash <Password Hash>

Configures the password using an encrypted representation of the password.

The password is not visible as text on the terminal command line, or in the command history.

Use this option if it is necessary to change passwords using a script.

You can generate the hash version of the password using standard Linux hash generating utilities.

realname <Name>

Configures user's description - most commonly user's real name.

This is an alphanumeric string that can contain spaces.

The default is the username with capitalized first letter.

shell <Login Shell>

Configures the user's default login shell.

See the explanations in the "Login Shells" section below.

Shell

Instructions

/etc/cli.sh

This is the default option.

Lets the user work with the full Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

By default, some basic networking commands (such as ping) are also available.

The Extended Commands in the assigned roles makes it possible to add more Linux commands that can be used (see List of Available Extended Commands in Roles).

User can run the expert command to enter the Bash shell (Expert mode).

/bin/bash

BASH Linux shell.

Lets the user work with the Expert mode.

User can run the clish command to enter the Gaia Clish.

User can run the gclish command to enter the Gaia gClish.

/bin/csh

CSH Linux shell.

User can run the clish command to enter the Gaia Clish.

User can run the gclish command to enter the Gaia gClish.

/bin/sh

SH Linux shell.

User can run the clish command to enter the Gaia Clish.

User can run the gclish command to enter the Gaia gClish.

/bin/tcsh

TCSH Linux shell.

User can run the clish command to enter the Gaia Clish.

User can run the gclish command to enter the Gaia gClish.

/usr/bin/scponly

User is not allowed to log in to Gaia.

User can only connect to Gaia over SCP and transfer files to and from the system.

Other commands are forbidden.

/sbin/nologin

User is not allowed to log in to Gaia.

/bin/p1shell

Obsolete.

Important - The p1shell is not supported (Known Limitation PMTR-45085).