How to add space to a Checkpoint firewall

here is a brief procedure on how to add space when you run out of it on a Checkpoint firewall.
Of course this procedure applies to any Linux box.

1. add disk to system
2. check with fdisk -l that disk is visible
3. create partition on system via fdisk and assign type LVM 0x8e (i.e. /dev/sdb1)
4. pvcreate /dev/sdb1
5. vgextend VGname Partition ( i.e. vgextend vg_splat /dev/sdb1 )
6. launch utility lvm_manager
7. choose to resize the logical volume that needs to be resized

But what if the disk is bigger than 2TB ?

fdisk does not support this kind of disk so you need to use parted

Let's say that you have an HP server and a logical drive with this device driver

/dev/cciss/c0d1

1. parted
2. select /dev/cciss/c0d1
3. mklabel gpt (to create a GPT table )
4. mkpart primary 0 -1 ( to create a partition using all disk space)
5. set 1 lvm on ( to change type of partition to LVM)
6. quit

At this point you can run pvcreate and vgextend as before using /dev/cciss/c0d1p1 partition.

Uncover the Meaning of top's Statistics

Interesting article I found on the Internet (http://www.linux.com/learn/tutorials/42048-uncover-the-meaning-of-tops-statistics)

Its name is kind of unique for something that shows system statistics: top. It is a part of the procps package, a set of Linux utilities that provide system information. Besides top, procps also includes free, vmstat, ps, and many other tools.
Top gives you a snapshot of a system's situation, e.g., free physical memory, number of running tasks, percentage of CPU time usage of each processes--all in a single view. So it's like using ps, free, and uptime at the same time. Top gets most of its information from several files under the /proc directory. You might already be aware that this directory provides users with a broad range of system-wide statistics, but thanks to top, we can summarize most of them inside a single organized window.
Furthermore, with top you can do things like:

Evasion techniques

Evasion & the limitations of legacy AV tools: Zeus banking malware hides a crucial file in a photo computerworld.com/s/article/9246… via @computerworld http://twitter.com/#!/thecyberwire/status/435843412919476224 > via Android Pro Widgets

Checkpoint Gaia - How to reset expert password in Gaia

If you happen to forget the expert mode password on CheckPoint Gaia OS, you could find the CheckPoint SecureKnowledge SK92347 (http://supportcontent.checkpoint.com/solutions?id=sk92347) that requires Expert access
Actually if you have at least SSH access to the system you do not need much more that the hash from another user's password. With that hash you can execute a CLISH command to fix your problem

From the "show configuration" command you look for the hash, i.e.:

set user lchiavacci password-hash $1$cQ3vKZFw$cHR$T3gMqcyqP0HdKx12P9

 you copy the hash and execute the command

set expert-password-hash $1$cQ3vKZFw$cHR$T3gMqcyqP0HdKx12P9

at this point the expert password is the same of user lchiavacci

Try it and let me know if it works for you

CheckPoint - Troubleshooting URLF blade e Identity Awareness

Here are some commands that I use to troubleshoot the integration between Identity Awareness and URL Filtering

Adlog
[Expert@cpfirewall01:0]# adlog a dc

Domain controllers:
Domain Name             IP Address              Connection state                Events in the last hour
===============================================================================================
acme.net;   10.100.17.101;            has connection;                 16531
acme.net;   10.100.17.102;            has connection;                 12230
acme.net;   10.200.28.8;              has connection;                 1436
acme.net;   10.200.35.195;            has connection;                 640
acme.net;   10.200.36.71;             has connection;                 2758
acme.net;   10.200.39.76;             has connection;                 656
acme.net;   10.200.52.10;             has connection;                 1768

Ignored domain controllers on this gateway:
acme.net
        => 10.200.32.48
        => 10.200.34.18

CheckPoint ha rilasciato uno script per rimuovere vecchie versioni di software

ciao a tutti
la sk91060 pubblicata recentemente da CheckPoint sembra risolvere i problemi di vecchie release di software che rimangono sul sistema.

Tutta da provare.

Comandi CheckPoint

Collezione di comandi per sistemi CheckPoint che ho trovato su vari blog Internet.
(lista soggetta ad aggiornamento...)

CP, FW and FWM

cphaprob stat	List cluster status
cphaprob -a if	List status of interfaces
cphaprob syncstat	shows the sync status
cphaprob list	Shows a status in list form
cphastart/stop	Stops clustering on the specfic node
cp_conf sic	SIC stuff
cpconfig	config util
cplic print	prints the license
cprestart	Restarts all Check Point Services
cpstart	Starts all Check Point Services
cpstop	Stops all Check Point Services
cpstop -fwflag -proc	Stops all checkpoint Services but keeps policy active in kernel
cpwd_admin list	List checkpoint processes
cplic print	Print all the licensing information.
cpstat -f all polsrv	Show VPN Policy Server Stats
cpstat	Shows the status of the firewall
fw tab -t sam_blocked_ips	Block IPS via SmartTracker
fw tab -t connections -s	Show connection stats
fw tab -t connections -f	Show connections with IP instead of HEX
fw tab -t fwx_alloc -f	Show fwx_alloc with IP instead of HEX
fw tab -t peers_count -s	Shows VPN stats
fw tab -t userc_users -s	Shows Secureclients connected
fw checklic	Check license details
fw ctl get int [global kernel parameter]	Shows the current value of a global kernel parameter
fw ctl set int [global kernel parameter] [value]	Sets the current value of a global keneral parameter. Only Temp ; Cleared after reboot.
fw ctl arp	Shows arp table
fw ctl install	Install hosts internal interfaces
fw ctl ip_forwarding	Control IP forwarding
fw ctl pstat	System Resource stats
fw ctl uninstall	Uninstall hosts internal interfaces
fw exportlog .o	Export current log file to ascii file
fw fetch	Fetch security policy and install
fw fetch localhost	Installs (on gateway) the last installed policy.
fw hastat	Shows Cluster statistics
fw lichosts	Display protected hosts
fw log -f	Tail the current log file
fw log -s -e	Retrieve logs between times
fw logswitch	Rotate current log file
fw lslogs	Display remote machine log-file list
fw monitor	Packet sniffer
fw printlic -p	Print current Firewall modules
fw printlic	Print current license details
fw putkey	Install authenication key onto host
fw stat -l	Long stat list, shows which policies are installed
fw stat -s	Short stat list, shows which policies are installed
fw unloadlocal	Unload policy
fw ver -k	Returns version, patch info and Kernal info
fwstart	Starts the firewall
fwstop	Stop the firewall
fwm lock_admin -v	View locked admin accounts
fwm dbexport -f user.txt	used to export users , can also use dbimport
fwm_start	starts the management processes
fwm -p	Print a list of Admin users
fwm -a	Adds an Admin
fwm -r	Delete an administrator

VPN

vpn tu	VPN utility, allows you to rekey vpn
vpn ipafile_check ipassignment.conf detail‏	Verifies the ipassignment.conf file
dtps lic	show desktop policy license status
cpstat -f all polsrv	show status of the dtps
vpn shell /tunnels/delete/IKE/peer/[peer ip]	delete IKE SA
vpn shell /tunnels/delete/IPsec/peer/[peer ip]	delete Phase 2 SA
vpn shell /show/tunnels/ike/peer/[peer ip]	show IKE SA
vpn shell /show/tunnels/ipsec/peer/[peer ip]	show Phase 2 SA
vpn shell show interface detailed [VTI name]	show VTI detail