Advanced Gaia Configuration

Configuring the Gaia Portal Web Server

Description

You can configure the server responsible for the Gaia PortalClosed Web interface for the Check Point Gaia operating system..

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently.

Parameter

Description

daemon-enable {on | off}

Enables or disables the Gaia Portal web daemon.

  • Range: on, or off

  • Default: on

session-timeout <Timeout>

Configures the time (in minutes), after which the HTTPS session to the Gaia Portal terminates.

  • Range: 1 - 720

  • Default: 15

ssl-port <Port>

Configures the TCP port number, on which the Gaia Portal can be accessed over HTTPS.

  • Range: 1 - 65535

  • Default: 443

Use this command for initial configuration only.

Changing the port number on the command line may cause inconsistency with the setting defined in SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on.. Use SmartConsole to set the SSL port for the Portal.

Note - This setting does not affect HTTP connections. Normally this port should be left at the default 443. If you change the port number, you must change the URL used to access the Gaia Portal from https://<Hostname or IP Address>/ to https://<Hostname or IP Address>:<PORTNUMBER>

ssl3-enabled {on | off}

Enables or disables the HTTPS SSLv3 connection to Gaia Portal.

  • Range: on, or off

  • Default: off

table-refresh-rate <Rate>

Configures the refresh rate (in seconds), at which some tables in the Gaia Portal are refreshed.

  • Range: 10 - 240

  • Default: 10

Resetting the Expert Mode Password on a Security Gateway

If you forget your Expert mode password for a Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. or Cluster MemberClosed Security Gateway that is part of a cluster., follow sk106490.

Configuring Supported SSH Ciphers, MACs, and KexAlgorithms

Description

You can configure different settings for the SSH daemon on the Gaia Operating System.

You can configure these SSH settings in Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

  1. Connect to the command line on the Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. / Security Gateway.

  2. Log in to the Expert mode.

  3. Back up the current configuration file:

    cp -v /etc/ssh/templates/sshd_config.templ{,BKP}

  4. Edit the current configuration file:

    vi /etc/ssh/templates/sshd_config.templ

  5. Configure the applicable SSH Ciphers, edit the line that starts with the word Ciphers:

    Ciphers VALUE1,VALUE2,...,VALUEx

    Notes:

    • If this line does not exist, add it.

    • By default, Gaia OS uses the first configured Cipher.

    • Values must be separated by commas without spaces.

  6. Configure the applicable SSH Message Authentication Codes (MACs), edit the line that starts with the word Macs:

    Macs VALUE1,VALUE2,...,VALUEx

    Notes:

    • If this line does not exist, add it.

    • By default, Gaia OS uses the first configured MAC.

    • Values must be separated by commas without spaces.

  7. Configure the applicable SSH Key Exchange Algorithms, edit the line that starts with the word KexAlgorithms:

    KexAlgorithms VALUE1,VALUE2,...,VALUEx

    Notes:

    • If this line does not exist, add it.

    • By default, Gaia OS uses the first configured KexAlgorithm.

    • Values must be separated by commas without spaces.

  8. Save the changes in the file and exit the editor.

  9. Import the updated configuration into the Gaia OS database:

    /bin/sshd_template_xlate < /config/active

  10. Restart the SSH server:

    service sshd restart

  1. Connect to the command line on the Gaia OS server.

  2. Log in to the Expert mode.

  3. Back up each of these configuration files:

    cp -v /etc/ssh/ssh_config{,BKP}

    cp -v /etc/ssh/sshd_config{,BKP}

  4. Edit each of these configuration files:

    vi /etc/ssh/ssh_config

    vi /etc/ssh/sshd_config

  5. Configure the applicable SSH Ciphers, edit the line that starts with the word Ciphers:

    Ciphers VALUE1,VALUE2,...,VALUEx

    Notes:

    • If this line does not exist, add it.

    • By default, Gaia OS uses the first configured Cipher.

    • Values must be separated by commas without spaces.

  6. Configure the applicable SSH Message Authentication Codes (MACs), edit the line that starts with the word Macs:

    Macs VALUE1,VALUE2,...,VALUEx

    Notes:

    • If this line does not exist, add it.

    • By default, Gaia OS uses the first configured MAC.

    • Values must be separated by commas without spaces.

  7. Configure the applicable SSH Key Exchange Algorithms, edit the line that starts with the word KexAlgorithms:

    KexAlgorithms VALUE1,VALUE2,...,VALUEx

    Notes:

    • If this line does not exist, add it.

    • By default, Gaia OS uses the first configured KexAlgorithm.

    • Values must be separated by commas without spaces.

  8. Save the changes in the file and exit the editor.

  9. Restart the SSH server:

    service sshd restart