Check point block a single IP address

 

Using Suspicious Activity Monitoring (SAM)

Connect to the firewall via SSH and log into Expert mode:

expert

Run the fw sam command to block traffic to and from the target IP:
fw sam -t 0 -b -s <IP_Address>
• -t 0 sets the timeout (0 means indefinite, or specify seconds like -t 3600 for 1 hour).
• -b blocks both source and destination directions.
• -s specifies the source IP address to block. [1]

Alternatively, for high-performance accelerated drops using SecureXL, you can use the fwaccel dos deny utility: [1]

fwaccel dos deny -a <IP_Address>

fw samp block -d <IP-Address> -u <Unique-Name>

fw samp unblock -u block_bad_ip
 

Useful Check Point Commands

 

Useful Check Point Commands

Table 1. Useful CP Commands

Command	Description
cpconfig	change SIC, licenses and more
cpview -t	show top style performance counters
cphaprob stat	list the state of the high availability cluster members. Should show active and standby devices.
cphaprob -a if	display status of monitored interfaces in a cluster
cphaprob -l list	display registered cluster devices and status
cphaprob syncstat	display sync transport layer statistics
cphaprob ldstat	display sync serialization statistics
cphastop	stop a cluster member from passing traffic. Stops synchronization. (emergency only)
clusterXL_admin down –p	disable this node from cluster membership
cphaconf cluster_id get	get cluster Global ID membership
cphaconf set_ccp broadcast/multicast	set cluster mode
cplic print	license information
cpstart	start all checkpoint services
cpstat fw	show policy name, policy install time and interface table
cpstat ha	high availability state
cpstat blades	top rule hits and amount of connections
cpstat os -f all	checkpoint interface table, routing table, version, memory status, cpu load, disk space
cpstat os -f cpu	checkpoint cpu status
cpstat os -f multi_cpu	checkpoint cpu load distribution
cpstat os -f sensors	hardware environment (temperature/fan/voltage)
cpstat os -f routing	checkpoint routing table
cpstat mg -f log_server	monitor log servers performance (events/sec)
cpstat -f log_connection fw	monitor log servers settings
cpstop	stop all checkpoint services
cpwd_admin monitor_list	list processes actively monitored. Firewall should contain cpd and vpnd.
show sysenv all	show hardware sensors (fans,power supply,temp,volt)
show asset all	show serial numbers and hardware info
show route destination xx.xx.xx.xx	show routing for specific host
ip route get xx.xx.xx.xx	show routing for specific host
iclid / show cluster state	show cluster fail over history
promote_util	promote the Secondary Management server to become the Primary server
cp_conf sic init key123 norestart	reset SIC without restarting the firewall process

Useful FW Commands

Table 2. Useful FW Commands

Command	Description
fw ver	firewall version
fw ctl iflist	show interface names
fw ctl pstat	show control kernel memory and connections
fwaccel stat	show SecureXL status
fw fetch <manager IP>	get the policy from the firewall manager
fwm load <policy name> <gateway name>	compile and install a policy on the target's gateways.
fw getifs	list interfaces and IP addresses
fw log	show the content of the connections log
fw log -b "MMM DD, YYYY HH:MM:SS" "MMM DD, YYYY HH:MM:SS"	search the current log for activity between specific times
fw log -c drop	search for dropped packets in the active log; also can use accept or reject to search
fw log -f	tail the current log
fwm logexport -i <log name> -o <output name> -n -p	export an old log file on the firewall manager
fw logswitch	rotate logs
fw lslogs	list firewall logs
fw stat	firewall status, should contain the name of the policy and the relevant interfaces.
fw stat -l	show which policy is associated with which interface and package drop, accept and reject
fw tab	displays firewall tables
fw tab -s -t connections	number of connections in state table
fw tab -f -t vpn_routing -u	routing for remote vpns
fw tab -s -t userc_users	number of remote users connected (VPN)
fw tab -t xlate -x	clear all translated entries
fw unloadlocal	clear local firewall policy
fw monitor -e "accept host(10.1.1.10);"	trace the packet flow to/from the specified host
fw ctl zdebug + drop | grep 'x.x.x.x\|y.y.y.y'	Check reason of your packet being dropped

 

Checking Root Account Status

 

Checking Local Root Account Status

Run sudo passwd -S root: Look for the status letter in the output. An L means the account is locked (disabled), while a P means it has a usable password.
Check /etc/shadow directly: Run sudo getent shadow root or sudo grep root /etc/shadow. If the second field (the password hash field) starts with an ! or *, the password is locked and direct login is disabled. [1, 2]

Checking Remote SSH Root Login Status

Test the effective SSH setting: Run sudo sshd -T | grep permitrootlogin. If it outputs permitrootlogin no or prohibit-password, remote root access via password is disabled.
Inspect the configuration files: Check /etc/ssh/sshd_config and files inside /etc/ssh/sshd_config.d/ for PermitRootLogin no

Ubuntu Unsupported upgrades

 Unsupported upgrades

Sometimes do-release-upgrade isn't able to run the upgrade to the latest version and it shows an error similar to this:

An upgrade from 'eoan' to 'focal' is not supported with this tool.

If that happens, you need to download a version-specific upgrader, you can find the link at https://changelogs.ubuntu.com/meta-release.

You need to download the upgrade tool for the version you are upgrading to. For example, if you are upgrading to Ubuntu 20.04 (focal), you'll see the link on that page as follows:

UpgradeTool: http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz

The download is an archive which contains an executable with the code name of the release. execute it to run the upgrade tool for that release. Note that the archive extracts everything in the current directory so you might want to create a directory for it to extract into:

# Downloads the upgrader, check the link above for the URL of the file for your release
wget http://archive.ubuntu.com/ubuntu/dists/focal-updates/main/dist-upgrader-all/current/focal.tar.gz
# Extract it into a new directory
mkdir upgrader
tar -xaf focal.tar.gz -C upgrader
cd upgrader
# Run the executable, the name changes based on the release
./focal

This executable works the same as do-release-upgrade. If you still get the error of the upgrade not being supported, you might need to make an intermediate upgrade to an earlier version.

Adicionar registro DNS windows linha de comando

 Usando o Prompt de Comando (dnscmd)Abra o Prompt de Comando como Administrador e utilize a seguinte estrutura para adicionar um registro do tipo A (endereço IP):
dnscmd . /RecordAdd <NomeDaZona> <NomeDoHost> A <EnderecoIP>
Exemplo prático: 
dnscmd . /RecordAdd meu-dominio.com meu-servidor A 192.168.1.50

O ponto . indica que você está gerenciando o servidor DNS local.
Usando o PowerShell (Add-DnsServerResourceRecordA)
Abra o Windows PowerShell como Administrador e execute o comando correspondente para a zona de pesquisa direta:
Add-DnsServerResourceRecordA -Name <NomeDoHost> -IPv4Address <EnderecoIP> -ZoneName <NomeDaZona>
Exemplo prático: Add-DnsServerResourceRecordA -Name meu-servidor -IPv4Address 192.168.1.50 -ZoneName meu-dominio.com 

SNMP Oracle Linux

 

sudo yum install net-snmp net-snmp-utils -y 

 

nano /etc/snmp/snmpd.conf 

agentAddress  udp:10.20.1.2:161
rocommunity public

systemctl restart snmpd
 

Change 'mysql_native_password' authentication

 Plugin mysql_native_password reported: ''mysql_native_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'


You can identify the affected users by running the following query in your MySQL console

SELECT user, host, plugin FROM mysql.user WHERE plugin='mysql_native_password';

Once you identify the users, update their authentication plugin using this command
ALTER USER 'user'@'location' IDENTIFIED WITH caching_sha2_password BY 'password';
FLUSH PRIVILEGES;

If your application or framework (such as an older version of PHP, Node.js, or a specific driver)
 does not support caching_sha2_password, you can use sha256_password as an alternative