topic Re: Possible to update password on a user by uploading a new config? in General Topics

Possible to update password on a user by uploading a new config?

ThomasEikeland — Mon, 05 Dec 2022 08:14:34 GMT

Hi, i am new to palo alto and firewalls really. I have been tasked to be able to make a script which automatically can change the password on a palo alto firewall. Is it possible to do this by creating a new config file with a new password and then upload to the firewall?

Re: Possible to update password on a user by uploading a new config?

BPry — Mon, 05 Dec 2022 17:03:48 GMT

@ThomasEikeland,

The problem that you'll run into isn't that it isn't possible, but that the passwords are hashed in the configuration and stored as a phash value. That being said, as long as you know what to set the phash value to, modifying it and uploading the configuration and committing it via the API isn't a problem at all.

The thing that you'll have to be mindful of is that your API account that you're using is something you wouldn't want to upgrade the password to. This will invalidate your keys, and you'd have to go back through and re-generate them with the new password. This is something you can easily work around and even automate updating through something like Vault, but it's good to be mindful of the consequences of rotating those credentials.

Re: Possible to update password on a user by uploading a new config?

ThomasEikeland — Tue, 06 Dec 2022 12:17:39 GMT

Thank you!