monitor FWM,FWD,CPD

cpwd_admin list

Crontab – Quick Reference

Setting up cron jobs in Unix and Solaris

cron is a unix, solaris utility that allows tasks to be automatically run in the background at regular intervals by the cron daemon. These tasks are often termed as cron jobs in unix , solaris. Crontab (CRON TABle) is a file which contains the schedule of cron entries to be run and at specified times.

This document covers following aspects of Unix cron jobs
1. Crontab Restrictions
2. Crontab Commands
3. Crontab file – syntax
4. Crontab Example
5. Crontab Environment
6. Disable Email
7. Generate log file for crontab activity

1. Crontab Restrictions
You can execute crontab if your name appears in the file /usr/lib/cron/cron.allow. If that file does not exist, you can use
crontab if your name does not appear in the file /usr/lib/cron/cron.deny.
If only cron.deny exists and is empty, all users can use crontab. If neither file exists, only the root user can use crontab. The allow/deny files consist of one user name per line.

2. Crontab Commands

export EDITOR=vi ;to specify a editor to open crontab file.

crontab -e Edit your crontab file, or create one if it doesn’t already exist.
crontab -l Display your crontab file.
crontab -r Remove your crontab file.
crontab -v Display the last time you edited your crontab file. (This option is only available on a few systems.)

3. Crontab file
Crontab syntax :
A crontab file has five fields for specifying day , date and time followed by the command to be run at that interval.

* * * * * command to be executed
- - - - -
| | | | |
| | | | +----- day of week (0 - 6) (Sunday=0)
| | | +------- month (1 - 12)
| | +--------- day of month (1 - 31)
| +----------- hour (0 - 23)
+------------- min (0 - 59)
* in the value field above means all legal values as in braces for that column.
The value column can have a * or a list of elements separated by commas. An element is either a number in the ranges shown above or two numbers in the range separated by a hyphen (meaning an inclusive range).
Notes
A. ) Repeat pattern like /2 for every 2 minutes or /10 for every 10 minutes is not supported by all operating systems. If you try to use it and crontab complains it is probably not supported.

B.) The specification of days can be made in two fields: month day and weekday. If both are specified in an entry, they are cumulative meaning both of the entries will get executed .

4. Crontab Example
A line in crontab file like below removes the tmp files from /home/someuser/tmp each day at 6:30 PM.

30 18 * * * rm /home/someuser/tmp/*

Changing the parameter values as below will cause this command to run at different time schedule below :

min hour day/month month day/week Execution time
30 0 1 1,6,12 * – 00:30 Hrs on 1st of Jan, June & Dec.
0 20 * 10 1-5 –8.00 PM every weekday (Mon-Fri) only in Oct.
0 0 1,10,15 * * – midnight on 1st ,10th & 15th of month
5,10 0 10 * 1 – At 12.05,12.10 every Monday & on 10th of every month
:
Note : If you inadvertently enter the crontab command with no argument(s), do not attempt to get out with Control-d. This removes all entries in your crontab file. Instead, exit with Control-c.

5. Crontab Environment
cron invokes the command from the user’s HOME directory with the shell, (/usr/bin/sh).
cron supplies a default environment for every shell, defining:
HOME=user’s-home-directory
LOGNAME=user’s-login-id
PATH=/usr/bin:/usr/sbin:.
SHELL=/usr/bin/sh

Users who desire to have their .profile executed must explicitly do so in the crontab entry or in a script called by the entry.

6. Disable Email
By default cron jobs sends a email to the user account executing the cronjob. If this is not needed put the following command At the end of the cron job line .

>/dev/null 2>&1

7. Generate log file
To collect the cron execution execution log in a file :

30 18 * * * rm /home/someuser/tmp/* > /home/someuser/cronlogs/clean_tmp_dir.log

SSL VPN on a Check Point Gateway

Create a new network object. This will be used as the remote users IP address. Name this "net_office-mode-IPs"

Within the Check Point Object under Tolopogy > VPN Domain add your local domain.
Within the Check Point Object under Remote Access make the following changes : Enable Support Vistor Mode

Within the Check Point Object under Office Mode - Select "Allow Office Mode to all users". Add this new network object under Manual (Allocate IP address from Network)
Within the Check Point Object Under Client VPN - Tick Support Clientless VPN. Under Certificate for gateway authentication select ICA_CERT.

Within the Check Point Object under SSL Clients - Tick the SSL Network Extender and select the ICA_CERT as the The gateway authenticates with this certificate.

Within the VPN community Tab under your Remote Access community. Add your Gateway as a paricipating gateway.

Within the Users Tab create your users and add these to a new user group.
Create a Rule for to allow access from your usergroups to your internal hosts (local encryption domain) and select your Remote Access Community

check which CP components are installed with the 'cpprod_util' command

admin]# cpprod_util CPPROD_GetKeyValues products 0

LDAP Configuration

Proceed as follows:

In SmartDashboard, select "Policy > Global Properties > SmartDirectory" and enable "Use SmartDirectory".

Create a node object. (In SmartDashboard, select 'Manage > Network Objects > New > Node > Host'.) Type in a descriptive name and the IP address of the LDAP Server.

Create a user template to represent the LDAP users. (Select 'Manage > Users and Administrators > New > Template'.) You need to enter the name and configure the authentication method to "Check Point Password". (No other modification is mandatory here.)

Create an LDAP account unit. (Select 'Manage > Servers and OPSEC applications > New > LDAP Account Unit'.)

In the General Tab: Enter the LDAP Account Unit name, set the profile to Microsoft_AD, and select both the 'CRL Retrieval' and the 'User management' options.

In the Servers Tab: Click 'Add' and specify the node object, created previously, from the drop down list. Leave the port as "389", specify the login DN (i.e. cn=useraccount, cn=users, DC=Domain, DC=org) and specify the password for the specified login. The 'Read data from this server' and 'Write data to this server' options are both selected. (Do not select the Encryption tab as this is relevant for encrypted SSL.) Click 'OK' and 'Add' and then specify 'Early Version Compatibility server' from the drop-down list.(Same object created earlier.)

In the Objects management tab: The 'Manage objects on' is enabled on the previously defined Node object (that represents the LDAP/MSAD server). Click 'fetch branches'. (This must work before the LDAP authentication works.) You should see the AD branches appear. The 'prompt for password' option is not selected, and the 'Return entries' is set at its default value of "500".

In the Authentication tab: The 'Use common group path for queries' option is not selected. The 'Allowed authentication schemes' selected must include the 'Check Point Password' scheme. The 'Users default template' option should be selected. Choose the user template that was created previously. All other options are not selected/checked.


Create the necessary LDAP group. (Select 'Manage > Users and Administrators > New > LDAP Group'.) Enter the LDAP group name, and specify the previously created LDAP Account Unit. The "Group's scope" is set to "All Account-Unit's Users".

Create a rule specifying the above LDAP group, as the source. (When you right click on the 'SOURCE' column, specify 'Add Users Access'.) The destination and service in this example are set to "ANY". The VPN column is set to the Remote Access VPN community (Secure client/Secure Remote). The Action is "ACCEPT" and Track is set to "LOG".

Creating a Certificate Based Site to Site VPN between 2 Check Points Gateways

Site A

Create VPN Community

Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined"
Within Network Objects create a Externally Managed VPN gateway (For Site B) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Export the Certificate

Within the Servers and OPSEC applications tab right click "Servers > Trusted CAs > Internal CA" and select "New > CA > Trusted > New CA > Trusted."
Enter a name for your Certificate (such as VPN-CERT)
Under the Certificate Authority TYpe choose "External Check Point CA"
Click the External Check Point CA tab and select "Save As".
Save the Certificate


Site B

Create VPN Community

Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined".
Within Network Objects create a Externally Managed VPN gateway (For Site A) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Import the Certificate

Within the Servers and OPSEC applications tab right click Servers and select "New > CA > Trusted"
Enter a name such as VPN-CERT.
Under the Certificate Authority TYpe choose "External Check Point CA".
Click the External Check Point CA tab and select "Get".
Import the previously saved certificate from Site A.

Negate Cell

1.It says match on anything BUT what you've got in the cell.

A classic use of the rule might be:

Src: h-web_proxy - Dst: NEGATED g-internal_networks - Service: http, https.

This says "the web proxy is allowed to connect to anywhere OTHER THAN our internal networks, on http and https.



2.It just does a reverse of what it would be normally.

ie

you create a rule that allows

src = internal net
dst = any
srv = http(negate)
action = accept

Instead of allowing http out to the Internet, it allows everything but http out to the internet.

It is quite common to see a group defined that contains all of the internal and dmz networks and then negate that group in the destination column to allow internet access.

This therefore allows access to anywhere but the networks group.