TMA-CHECKPOINT-ADMIN-SHELL
Ensure the admin user shell is clish
MediumLevel 1Automatedcheckpoint
Description
Giving admin the Expert bash shell by default bypasses clish role controls. PASS requires 'set user admin shell /etc/cli.sh'. Audited against the Gaia clish 'show configuration' output.
How it is checked
Audit method: Configuration pattern
- Pattern
(?m)^set user admin shell /etc/cli\.sh[ \t]*$
How it is fixed
Fix method: Guidance or infrastructure patch
set user admin shell /etc/cli.sh save config WebUI: User Management > Users > admin > Shell = /etc/cli.sh.
Properties
- Operating systems
- Any
- Tags
- checkpointauthenticationmanagement
- Reference
- CIS Check Point Firewall Benchmark - User Management - Admin shell (verify section number for your Gaia release)
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target checkpoint