CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


Tim Hall has done it again! He has just released the 2nd edition of "Max Power".
Rather than get into details here, I urge you to check out this announcement post.
It's a massive upgrade, and well worth checking out. -E

 

Results 1 to 10 of 10

Thread: Error when logging into CLI of Provder-1 server

  1. #1
    Join Date
    2017-04-27
    Posts
    5
    Rep Power
    0

    Default Error when logging into CLI of Provder-1 server

    When logging into the P1 server via CLI with any account other than "admin" I get the following error:

    "error: couldn't get the user ID"

    This repeats several times and then returns to the prompt. Has anyone seen this and what is the fix?

  2. #2
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default Re: Error when logging into CLI of Provder-1 server

    Quote Originally Posted by ivyma View Post
    When logging into the P1 server via CLI with any account other than "admin" I get the following error:

    "error: couldn't get the user ID"

    This repeats several times and then returns to the prompt. Has anyone seen this and what is the fix?
    Are you authenticating via SecurID, local account, RADIUS or TACACS?

  3. #3
    Join Date
    2007-03-30
    Location
    DFW, TX
    Posts
    250
    Rep Power
    12

    Default Re: Error when logging into CLI of Provder-1 server

    Quote Originally Posted by cciesec2006 View Post
    Are you authenticating via SecurID, local account, RADIUS or TACACS?
    Related, has this ever worked, or is this the first time you're trying to log in to this box with a non-"admin" user?

    What OS and version is this?

    How did you add the non-"admin" user?

    Are you connecting over SSH or locally on the console (either serial or keyboard/video)?
    Zimmie

  4. #4
    Join Date
    2017-04-27
    Posts
    5
    Rep Power
    0

    Default Re: Error when logging into CLI of Provder-1 server

    Radius auth and running R80.10

  5. #5
    Join Date
    2011-08-02
    Location
    http://spikefishsolutions.com
    Posts
    1,623
    Rep Power
    9

    Default Re: Error when logging into CLI of Provder-1 server

    Quote Originally Posted by ivyma View Post
    Radius auth and running R80.10
    I think the user none-local or something like that is the user you become when you login with radius. Can you show your /etc/passwd file? Also what shows up in /var/log/messages when you attempt a login?

  6. #6
    Join Date
    2017-04-27
    Posts
    5
    Rep Power
    0

    Default Re: Error when logging into CLI of Provder-1 server

    To answer your other question I am attempting to login via SSH. The /etc/passwd file is shown below:

    admin:x:0:0:Admin:/home/admin:/bin/bash
    monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
    root:x:0:0:root:/root:/sbin/nologin
    nobody:x:99:99:Nobody:/:/sbin/nologin
    postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
    rpm:x:37:37::/var/lib/rpm:/sbin/nologin
    shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
    pcap:x:77:77::/var/arpwatch:/sbin/nologin
    halt:x:7:0:halt:/sbin:/sbin/halt
    cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
    cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
    vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
    _nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

  7. #7
    Join Date
    2011-08-02
    Location
    http://spikefishsolutions.com
    Posts
    1,623
    Rep Power
    9

    Default Re: Error when logging into CLI of Provder-1 server

    Quote Originally Posted by ivyma View Post
    To answer your other question I am attempting to login via SSH. The /etc/passwd file is shown below:

    admin:x:0:0:Admin:/home/admin:/bin/bash
    monitor:x:102:100:Monitor:/home/monitor:/etc/cli.sh
    root:x:0:0:root:/root:/sbin/nologin
    nobody:x:99:99:Nobody:/:/sbin/nologin
    postfix:x:1001:1001:Postfix:/home/postfix:/sbin/nologin
    rpm:x:37:37::/var/lib/rpm:/sbin/nologin
    shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
    pcap:x:77:77::/var/arpwatch:/sbin/nologin
    halt:x:7:0:halt:/sbin:/sbin/halt
    cp_postgres:x:1008:0:Postgres:/home/cp_postgres:/bin/sh
    cpep_user:x:1500:1500::/home/cpep_user:/sbin/nologin
    vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
    _nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh
    That’s it _nonlocl. What does messages say when you login?

  8. #8
    Join Date
    2007-03-30
    Location
    DFW, TX
    Posts
    250
    Rep Power
    12

    Default Re: Error when logging into CLI of Provder-1 server

    To eliminate the _nonlocl stuff from being a potential problem, I would recommend trying this:

    Code:
    add user zimmie uid 103 homedir /home/zimmie
    set user zimmie gid 0 shell /bin/bash
    add rba user zimmie roles adminRole
    save config
    Replace my username with your own, of course, and you can pick any UID you feel like as long as it isn't already used. This will create a local user with no password (which prevents local authentication from working). Authentication attempts are then passed to the RADIUS or TACACS server. The user needs to exist on the RADIUS/TACACS server (or on an upstream authentication server) for this to work.

    In addition to the /var/log/messages file, I would also look at the /var/log/secure and /var/log/auth files. Those both contain data specifically on authentication attempts, and messages in them tend to be more verbose than the equivalent lines in /var/log/messages. The idea is they are only readable by people who already have root privileges, so it's safer to include details which could compromise security, such as specific reasons for authentication failures.
    Zimmie

  9. #9
    Join Date
    2006-09-26
    Posts
    3,150
    Rep Power
    15

    Default Re: Error when logging into CLI of Provder-1 server

    Quote Originally Posted by jflemingeds View Post
    Thatís it _nonlocl. What does messages say when you login?
    I integrate Cisco ACS radius with R80.10 and it works for me:

    add user cciesec uid 0 homedir /home/cciesec

    add rba role netread domain-type System all-features

    add rba user cciesec roles netread

    cciesec is the account defined on the ACS server. It allows me to ssh and log into the R80.10 box.

  10. #10
    Join Date
    2007-03-30
    Location
    DFW, TX
    Posts
    250
    Rep Power
    12

    Default Re: Error when logging into CLI of Provder-1 server

    Quote Originally Posted by cciesec2006 View Post
    I integrate Cisco ACS radius with R80.10 and it works for me:

    add user cciesec uid 0 homedir /home/cciesec

    add rba role netread domain-type System all-features

    add rba user cciesec roles netread

    cciesec is the account defined on the ACS server. It allows me to ssh and log into the R80.10 box.
    If you do it with a non-zero UID, you can use SSH key authentication, then use sudo (configured in whatever way you want) to elevate to root.
    Zimmie

Similar Threads

  1. Error while logging into the SmartCenter
    By rajeevraj in forum Miscellaneous
    Replies: 1
    Last Post: 2010-09-20, 10:07
  2. Cant Add a Logging Server
    By g3xer in forum Windows
    Replies: 2
    Last Post: 2010-02-25, 03:48
  3. Getting Error while logging through MIP on director
    By brijesh_techno in forum Nortel ASF/NSF
    Replies: 2
    Last Post: 2009-01-09, 03:09
  4. Server Hardening / SmartCentre Logging
    By slands10 in forum Security Management Server (Formerly SmartCenter Server ((Formerly Management Server))
    Replies: 2
    Last Post: 2007-10-16, 06:39
  5. migrated to new Mgmt server but no logging?
    By tdvit in forum SmartView Tracker
    Replies: 4
    Last Post: 2006-08-14, 11:27

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •