2.1.2 Check Point - BlueCat Infrastructure Assurance - 25.2.0

Creating User on GAiA WebUI Portal

1. Log in to the Check Point WebUI.

2. Go to User Management > Users > Add

   
   
   

3. Fill in the required information. It is important to set the Shell to /bin/bash and set the role to adminRole.

   
   
   

Creating Users via CLI

1. Log in to the Check Point device using SSH

2. Make sure you are in Clish. If you have the shell set to /bin/bash, run the command clish

3. Add the user (in the example we are using the username indeni):

   add user indeni uid 0 homedir /home/indeni

4. Set the password for the user:

   set user indeni password
   New password: [xxxx]
   Verify new password: [xxxx]

5. Type the following to add the access role adminRole:

   add rba user indeni roles adminRole

6. Type the following to set the shell to /bin/bash:

   set user indeni shell /bin/bash

Creating Chassis Users

Chassis users it’s only possible to be created via CLI. Follow this procedure to create the user:

1. Log in to the Check Point device using SSH

2. Make sure you are in Clish. If you have the shell set to /bin/bash, run the command clish

3. Add the user (in the example we are using the username indeni):

   add user indeni uid 0 homedir /home/indeni

4. Set the password for the user:

   set user indeni password
   New password: [xxxx]
   Verify new password: [xxxx]

5. Type the following to set the shell to /bin/bash:

   set user indeni shell /bin/bash

How to add CheckPoint chassis to LiveAssurance

Monitoring of CheckPoint chassis is made through the Unique IP Address For Chassis (UIPC). To check which UIP has the chassis configured the firewall administrator should run into a chassis device following command:

show chassis id <chassis_id> general unique_ip

where <chassis_id> could be:

• 1
• 2
• all

If chassis UIPC is not configured official documentation must be followed.

R76SP.50:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk115735

R80.20SP:

https://sc1.checkpoint.com/documents/R80.20SP/WebAdminGuides/EN/CP_R80.20SP_AdminGuide/html_frameset.htm?topic=documents/R80.20SP/WebAdminGuides/EN/CP_R80.20SP_AdminGuide/211530

Creating Maestro MHO and Security Group Users

Users on Maestro MHO devices can be created following the procedures previously described as valid for any other GAiA device:

• Creating User on GAiA WebUI Portal
• Creating Users via CLI

In the case of Security Groups the procedure is the same but, to connect to a Security Group, the management IP of the Security Group must be used over HTTPS or SSH depending on the method chosen.

How to add CheckPoint Maestro appliances to LiveAssurance

Maestro deployments are composed of two types of appliances, Maestro Hyperscale Orchestrator (MHO in advance) and Gateways. Gateways are grouped in logical units called Security Groups which work as a independent cluster of gateways.

The following image is an example, where the MHO has one Security Group.

LiveAssurance learns the IP address of the single management object for Security Group 1.

In both cases management IP address is used to monitor the devices.

MHO

Management IP address to be allowed to connect via SSH.

If the MHO is clustered, both devices will be monitored automatically under the added MHO.

Security Group

Management IP address is defined when Security Group is created into SmartConsole.

To check management IPs defined for Security Groups the firewall administrator should run into MHO following CLI command:

show maestro security-group id <Security Group ID>

where <Security Group ID> could be:

• 1
• 2
• …

Example:

If you are unable to connect to the Security Group, please refer to:

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk164372

Creating via GAiA Embedded

1. Login to the webUI

   
   
   

2. Go to Users & Objects > Administrators > New

   
   
   

3. Fill in the username and password and click Apply

   
   
   

4. Login with the user using SSH and type the command expert followed by the command bashUser on:

   
   
   

Connect using public/private SSH Keys

The SSH key is stored within the LiveAssurance application and not in the typical Linux OS location, therefore, device keys will need to be entered individually into the WebUI which can be doing by performing the following:

1. Log into the remote device

2. Make a note of which user LiveAssurance will connect with. This will be needed later. In our example below the username will be “indeni”

3. To create a public/private key pair, type the following:

   ssh-keygen -t rsa -b 4096 -f indeni-ssh –N

4. Create a folder called .ssh in the home folder of the user which will use Indeni, by typing in the following:

   mkdir /home/indeni/.ssh

5. Move the public key to the .ssh folder, and rename it to authorized_keys and set the correct permissions by typing the following:

   mv indeni-ssh.pub /home/indeni/.ssh/authorized_keys
   chmod 700 /home/indeni/.ssh
   chmod 600 /home/indeni/.ssh/authorized_keys

   OPTIONAL: For increased security, perform the following to render the password for the “indeni” account useless, allowing only the SSH key to login:

   dbset passwd:indeni:passwd “*”
   dbset save

6. Get the output the private key by typing the following:

   cat indeni-ssh

   OUTPUT EXAMPLE

   —–BEGIN RSA PRIVATE KEY—–MIIJJQIBAAKCAgEAp5UbPfn36Y1NIqbvJLPWvd128IfZ1FH5gt/E=……—–END RSA PRIVATE KEY—–

7. When adding the device into LiveAssurance, select SSH Private Key and input the entire content (including the dashes “—–BEGIN RSA PRIVATE KEY — and — END RSA PRIVATE KEY —–” of the RSA output.

   
   
   

Frequently Asked Questions

I’ve setup the user as described, but I cannot add the device