How to configure the Management Server to use credentials when it sends queries to an LDAP Server

Solution

Background

If it is necessary to configure security policy that is based on users that are configured on an LDAP server, you must configure an LDAP Account Unit object.

By default, the connection from the Management Server (from the LDAP Account Unit) to the LDAP Server (the Domain Controller) is performed anonymously, although you configure the credentials in the LDAP Account Unit object.

Check Point can provide a hotfix package for the Management Server, so it connects to the LDAP Server (the Domain Controller) with the credentials you configured in the LDAP Account Unit object.

WARNING - The Management Server does not encrypt the credentials it sends to the LDAP Server. To prevent a possible leak of the LDAP credentials, install this hotfix only if the communication is secured between the Management Server and the LDAP Server in your environment.

Procedure to Enable the New Behavior

1. This problem was fixed. The fix is included in:
   • Jumbo Hotfix Accumulator for R81.10 starting from Take 183

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

2. Enable the new behavior:

Note - On a Multi-Domain Security Management Server, this applies to all configured Domain Management Servers.

1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.

2. Log in.

3. If your default shell is Gaia Clish, then go to the Expert mode:

   expert

4. Temporarily set the environment variable FWM_ENABLE_LDAP_CREDENTIALS with the value 1 (digit "one") in the current session:

   1. Temporarily set the environment variable:

      $MDS_FWDIR/scripts/reload_env_vars.sh -e "FWM_ENABLE_LDAP_CREDENTIALS=1"

5. Make sure this environment variable was set:

     `grep -a 'FWM_ENABLE_LDAP_CREDENTIALS' /proc/$(pidof 'fwm')/environ`
   

   5. Permanently set the environment variable FWM_ENABLE_LDAP_CREDENTIALS with the value 1 (digit "one"):

      1. Permanently set the environment variable:

         $MDS_FWDIR/scripts/override_server_setting.sh -e FWM_ENABLE_LDAP_CREDENTIALS 1

6. When possible, restart the Check Point services: - On a Security Management Server:
   cpstop ; sleep 5 ; cpstart

• On a Multi-Domain Security Management Server:

       `mdsstop ; sleep 5 ; mdsstart`
  3. Make sure this environment variable was set:
     
     `grep -a 'FWM_ENABLE_LDAP_CREDENTIALS' /proc/$(pidof 'fwm')/environ`
  

Procedure to Disable the New Behavior

1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.

2. Log in.

3. If your default shell is Gaia Clish, then go to the Expert mode:

   expert

4. Unset set the environment variable FWM_ENABLE_LDAP_CREDENTIALS (see sk165938):

   1. $MDS_FWDIR/scripts/reload_env_vars.sh -u FWM_ENABLE_LDAP_CREDENTIALS

5. $MDS_FWDIR/scripts/override_server_setting.sh -u FWM_ENABLE_LDAP_CREDENTIALS

6. When possible, restart the Check Point services:

   • On a Security Management Server:

     cpstop ; sleep 5 ; cpstart

   • On a Multi-Domain Security Management Server:

     mdsstop ; sleep 5 ; mdsstart

7. Make sure this environment variable is not set:

   grep -a 'FWM_ENABLE_LDAP_CREDENTIALS' /proc/$(pidof 'fwm')/environ

You should just get a new shell prompt line.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.