How to add/create local user password directly via CLI?

[rahmant]

PA500, test unit running PANOS 3.1.4

When I enter a local user via the GUI, the corresponding XML in the configuration file is as follows:

<shared>

    <local-user-database>
      <user>
        <entry name="testuser">
          <phash>$hashvalue$</phash>
        </entry>
      </user>

...

I can add the username without issue, but is there a way to enter in the password directly?  Or do I have to hash it manually and then add the hash value via the CLI?  Which hash is used?  I tried running Hashcalc against the above testuser's original password, but came up mismatched against the listed <phash> value in the config using some of the common hashes (MD5, SHA1, SHA256, etc.)

Any thoughts?

Tariq

[nrice]

Hi Tariq,

You'd need to genrate the password on at least one PAN device and then could copy the hash into different config files.

[maxxian]

So based on the above question and XML extract, is the local database on the PA-500 just an XML file?

[James]

The config is XML, the logs are held in a proprietary DB

Thanks

James

[maxxian]

So migrating the users to a different database in the future would be difficult, right?

Unless there is some export function in the future?

[Richard_Bergen]

A little late to the party, but you can create the hash using the openssl command: openssl passwd -1 password