Change password for console expert user Checkpoint Splat

As seen many times Checkpoint has own way of doing otherwise simple and straightforward tasks. Changing
password for shell account is another example.
By default when installed Splat creates two console users – admin and root. You can’t login remotely
(i.e. by ssh) with root as /etc/ssh/sshd_config contains this:
DenyUsers root shutdown halt nobody ntp pcap rpm
AllowGroups root

So , basically you are left with admin user to do all command line tasks (Expert mode) – security flaw by itself, but even more,
when you try to change the password of this user by passwd command
Checkpoint doesn’t let you to. Even worse, it happily goes ahead and notifies you that password has been
successfully changed and … you can still log in only with the old password. The reason is here:

[Expert@cp]# which passwd
alias passwd=’/bin/expert_passwd’
/bin/expert_passwd
[Expert@cp]#

This way Splat tricks you into running some dummy ‘passw’ of its own that is only good for CPshell
environment. So to really change password of Expert user you have 2 options:
1) Through Web device management GUI (not covered her)
2) Use native passwd , see below

[Expert@cp]# /usr/bin/passwd rambo
Changing password for user rambo.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[Expert@cp]#

Here:
/usr/bin/passwd – Linux native passwd utility
rambo – Expert user I added to the system and then blocked remote login for user admin (or type
admin for default user).

Adding Expert user:
To add another user with id = 0 use switch -o:

[Expert@cp]# useradd -u 0 -g 0 -o -s /bin/bash rambo

Then change password as per above and fix /etc/ssh/sshd_config to allow rambo login and block
admin login

DenyUsers root shutdown halt nobody ntp pcap rpm admin
AllowGroups root