Tag: SPLAT

Posted on

How To Repair A Corrupt Smartcenter Installation

Repair A Corrupt Smartcenter Installation

This article details how to repair a corrupt smartcenter step-by-step. This process is valid for both Windows and *nix-based installations and platform-specific instructions are pointed out where necessary.

In fact, the word “repair” is somewhat misleading as what we really do is create a new smartcenter and use configuration files from the old install to effectively make a clone – all certificates, ICA, VPN etc will remain as they were so no re-SIC will be required with the gateway modules once you are up and running.

There are two ways to restore – minimal and complete. “Minimal” will make sure that all objects, rules, certificates and the user database are restored which is all that is needed a lot of the time. If however you would like to do a “complete” restore including licensing, database versions then the files are specified as well.

In addition, at the end of the article are two simple commands which can be used to gather up all of the files and place them in an archive for easy retrieval!

 

Minimal Restore Requirements

Objects and Rulebase

The following files are required to restore a smartcenter’s rulebase, objects and user database. The first two files are absolutely necessary and there is no point proceeding without them, fwauth.NDB is necessary to restore the user database:

  • $FWDIR/conf/objects_5_0.C
  • $FWDIR/conf/rulebases_5_0.fws
  • $FWDIR/conf/slprulebases_5_0.fws
  • $FWDIR/conf/fgrules.fws
  • $FWDIR/conf/fwauth.NDB

Notes:

  1. Check Point stores all the rulebases in one file, called ‘rulebases_5_0.fws’. This is the only rulebase file needed.
  2. Check Point stores the desktop security rulebase in a database file called ‘slprulebases_5_0.fws’ (Secure LAN Policy).
  3. Check Point stores all the objects, services, etc in one database file called ‘objects_5_0.C’.
  4. Check Point users are stored in the file ‘fwauth.NDB’.
  5. On Windows machines, %FWDIR%\conf\fwauth.NDB is only the pointer to the real user database file, for example, %FWDIR%\conf\fwauth.NDB522. In this case, rename the real database file %FWDIR%\conf\fwauth.NDB522 with the name %FWDIR%\conf\fwauth.NDB
Internal Certificate Authority Files

The ICA is what all other certificates are based on – SIC, VPN etc. restoreing these is necessary to avoid having to re-setup certificate-based VPNs, remote-worker certificates and re-establishing SICwith all managed gateways.

  • $FWDIR/conf/InternalCA.*
  • $FWDIR/conf/ICA*.*
  • $CPDIR/conf/sic_cert.p12
  • $FWDIR/conf/crls/*
Registry Data – SecurePlatform & Gaia

/opt/CPshared/registry/HKLM_registry.data

– copy everything under ‘SIC’

Registry Data – Windows OS

HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\SIC

(export this key and then import it on the target machine)

 

Full Restore Requirements

The following represents the complete set of files essential for a database restore:
• $CPDIR/conf/cp.license
• $CPDIR/conf/sic_cert.p12
• $CPDIR/database/*.C
• $CPDIR/registry/*
• $FWDIR/conf/lists/*
• $FWDIR/conf/*.fws
• $FWDIR/conf/*.conf (except for ‘components_reg.conf’, ‘fwrl.conf’, ‘cpmad_rulebase.conf’)
• $FWDIR/conf/masters
• $FWDIR/conf/fwmusers
• $FWDIR/conf/gui-clients
• $FWDIR/conf/*.C (except for ‘mv_doc.C’, ‘classes.C’, ‘scheme.C’, ‘fields.C’, ‘tables.C’, ‘rtmclasses.C’, ‘default_objects.C’)
• $FWDIR/conf/db_versions/Database/versioning_db.fws
• $FWDIR/conf/vpe/*
• $FWDIR/conf/XML/*
• $FWDIR/conf/cpsc/*
• $FWDIR/conf/I*
• $FWDIR/conf/crls/*
• $FWDIR/conf/db_versions/repository/*
• $FWDIR/conf/fwauth.NDB
• $FWDIR/conf/DiapCpdList.NDB
• $FWDIR/conf/DiapFwmList.NDB
• $FWDIR/conf/DAIP_RS_Database.NDB
• $FWDIR/conf/robo-gateways.NDB
• $FWDIR/conf/robo-control.NDB
• $FWDIR/conf/robo-ike.NDB

Note: If logs are required then the contents of $FWDIR/log/ should also be included (note that $FWDIR/log/ is a symbolic link to another partition on the hard disk and files should be retrieved from there).

Restore Process

  1. Back up the files noted herein, offloading to a secure location.
  2. Install the same version and feature set onto the replacement Security Management Server, ensuring that the same hostname and leading IP address are used.
  3. Perform the installation as though this was a clean (new) Security Management Server installation.
  4. If the new Security Management Server is rebooted at the conclusion of the installation, run ‘cpstop’ before restoring the files.
  5. Copy the backups from Step 1 to the fresh installation.
  6. Extract the backups to their appropriate locations.
  7.   Before executing ‘cpstart’, delete the $FWDIR/conf/applications.C and $FWDIR/conf/CPMILink*

Automate File Retrieval

Use the below commands to automate retrieval of the files specified above. The files will be bundled into two files named backup1.tgz and backup2.tgz

Note: This does assume that the Check Point path variables $CPDIR and $FWDIR are available:
[Expert@mgmt]# tar -czvf backup1.tgz $FWDIR/conf/objects_5_0.C $FWDIR/conf/gui-clients $FWDIR/conf/fwmusers $FWDIR/conf/rulebases_5_0.fws $FWDIR/conf/slprulebases_5_0.fws $FWDIR/conf/fgrules.fws $FWDIR/conf/fwauth.NDB $FWDIR/conf/InternalCA.* $FWDIR/conf/ICA*.* $CPDIR/conf/sic_cert.p12 $CPDIR/conf/cp.license $CPDIR/registry/HKLM_registry.data $FWDIR/conf/crls

 

[Expert@mgmt]# tar -czvf backup2.tgz $CPDIR/conf/cp.license $CPDIR/conf/sic_cert.p12 $CPDIR/database/*.C $CPDIR/registry $FWDIR/conf/lists/* $FWDIR/conf/*.fws $FWDIR/conf/*.conf $FWDIR/conf/fwmusers $FWDIR/conf/masters $FWDIR/conf/*.C $FWDIR/conf/db_versions/Database/versioning_db.fws $FWDIR/conf/gui-clients $FWDIR/conf/vpe/* $FWDIR/conf/XML/* $FWDIR/conf/cpsc/* $FWDIR/conf/I* $FWDIR/conf/crls/* $FWDIR/conf/*.NDB

Related posts:

Posted on

Checkpoint: Long Delay When Logging In Via SSH or Console

How to mitigate the issue where this a long delay when logging in via SSH or console.

When an SSH session is initiated to a linux box, the SSH server tries to perform a lookup on the client’s IP; in certain situations this is not going to be possible, e.g.:

  • the configured DNS server is offline
  • the firewall / smartcentre cannot talk to the configured DNS because of a policy
  • the external internet connection is down etc.etc.

This DNS timeout manifests itself as an incredibly long delay for the user trying to log in – fortunately there is a very quick fix for this:

  • delete the nameservers entirely!
  • configure nameservers that the machine is able to reach
  • use internal nameservers if your internet connection is flaky

This is the case for all Checkpoint linux-based machines as well as IPSO and Gaia.

Related posts:

Posted on

Checkpoint: How To Reset “expert” Mode Password On SecurePlatform

This article describes how to reset the expert mode password on SecurePlatform for your Checkpoint appliance or open server.

For Open Servers

Obtain the live linux distribution Knoppix. You can download the current version from the Knoppix website: http://www.knoppix.net

1. Boot the machine from the Knoppix CD – you can use a built-in CD/DVD drive or an external one.

2. Once the desktop appears, click on the icon to open a terminal window, the run the following commands. See also the “Notes” section below.

$ su
# mkdir /checkpoint
# mount /dev/hda2 /checkpoint
# mount /dev/hda1 /checkpoint/boot
# chroot /checkpoint
# /bin/expert_passwd

3. At this point you are prompted to enter a password – type in the new password twice.

4. To change the regular cpshell admin users’s password:

# passwd admin

You are prompted to enter a password.

Type in the new password twice.

5. Run the “exit” and then the “reboot” command.

6. Remove the Knoppix CD and boot normally.

You can now log in as the user ‘admin’ and log in to Expert mode with each of the new passwords you just assigned.

———————

Notes for Point 2:

If the mount /dev/hda2/checkpoint command fails, use the following command instead:

/dev/hda3/checkpoint

If the system has SATA drives then use the following command:

mount /dev/sda8 /checkpoint and /dev/sda2 /checkpoint/boot

An easy way to find drive mappings is to use gparted from Knoppix “K menu” > system > gparted.

Knoppix will not let you run this unless you have root and a password for root.

To create valid passwords use sudo passwd, i.e.

# sudo passwd root

You need to mount the root partition on /checkpoint, and the boot partition on /checkpoint/boot

———————

For UTM-1 Appliances *AND* Open Servers

1. Obtain the Red Hat boot CD. (The current Fedora Core boot CD will as also work).

2. At the boot prompt, boot from the Red Hat boot CD with the following command: “linux rescue ”

3. When prompted, answer the questions presented by the boot process.

4. The system is mounted on the hard drive, and its location is indicated. Write down the system location (which should be: /mnt/sysimage/, or /mnt/sysimage/).

5. When the command prompt is displayed again, edit the following file (Vi editor should be available): /mnt/sysimage/boot/grub/grub.conf

Find the line that looks like this:

password --md5 <a bunch of scrambled numbers, letters, and symbols>

Add a ‘#‘ at the very beginning of that line. It should then look like this:

#password --md5 <a bunch of scrambled numbers, letters, and symbols>

6. Find a line that opens with the word ‘lock‘ and add a ‘#’ at the very beginning of that line.

7. Save and exit the editing session.

8. Reboot the machine.

9. Remove the boot CD from the CD-ROM drive before it boots from the CD (again).

10. When the following prompt appears:

GRUB … (the dots increase in number until it boots the default kernel)

Press the ‘Space‘ key. This should display the GRUB menu.

11. Select the line that has the word ‘Maintenance‘ in it and press ‘Enter‘ key.Note: if this step fails to boot into the Maintenance mode, do the following:

Select the line that contains ‘maintenance‘ and press ‘e‘ key.You are allowed to edit the GRUB options for this boot option.

  • Press ‘b‘ key to boot this option.
  • SecurePlatform boots until a prompt similar to the following appears:sh-bash 2.0.5#
  • Change the passwords for:
    • A user, like ‘admin‘, run:
      \ passwd admin
    • For Expert mode, run:
      /bin/expert_passwd
  • Reboot.

 

 

 

Related posts:

Exit mobile version
%%footer%%