topic Re: R81.10 boot menu password in Firewall and Security Management

R81.10 boot menu password

S_E_ — Tue, 10 Oct 2023 09:16:38 GMT

Hi,

to reboot of a Smart-1 appliance into maintenance mode prompts for admin password.
According to sk109047, it should be the expert password.
However, it does not seem to work for R81.10 HF110
Ho can I reset the boot menu password ?
A set grub2-password does not exist (only R81.20)

Thanks, Regards

Gaia R81.10
+-------------------------------------------------------------------------+
| Revert from other image |
| Reset to factory defaults - Gaia R80.10 |
| Reset to factory defaults - Gaia R77.30 |
| Start in 64bit no-debug mode |
| Start in maintenance mode 64bit |
| Start in 64bit online debug mode |
| Start in 64bit normal mode |
| HW Diagnostics |
+-------------------------------------------------------------------------+
Use the ^ and v keys to select an entry.
Press enter to choose the boot option.
Admin password: ********
Failed!

SMS> set user admin password
New password:
Verify new password:

SMS> set expert-password
Enter current expert password:
Enter new expert password:
Enter new expert password (again):
SMS> save config
SMS> reboot

Re: R81.10 boot menu password

Alex- — Tue, 10 Oct 2023 09:23:28 GMT

Maybe this applies to your situation: https://community.checkpoint.com/t5/Security-Gateways/Unable-to-enter-maintenance-mode-when-expert-password-exceeds-26/m-p/147622

Re: R81.10 boot menu password

S_E_ — Tue, 10 Oct 2023 09:25:50 GMT

hi, unfortunately no. I used a very easy temporary pw.

Thanks Regards

Re: R81.10 boot menu password

_Val_ — Tue, 10 Oct 2023 10:17:40 GMT

Are you using a non-English locale by any chance?

Re: R81.10 boot menu password

the_rock — Tue, 10 Oct 2023 10:20:58 GMT

Maybe uranus?

Andy

Re: R81.10 boot menu password

_Val_ — Tue, 10 Oct 2023 10:23:34 GMT

Not BIOS password, Andy 🙂

Re: R81.10 boot menu password

_Val_ — Tue, 10 Oct 2023 10:23:50 GMT

Check this SK please: sk180176

Re: R81.10 boot menu password

the_rock — Tue, 10 Oct 2023 10:24:48 GMT

Duh...sorry, thats what I was thinking of.

Re: R81.10 boot menu password

S_E_ — Wed, 11 Oct 2023 13:29:08 GMT

Hi,

I tried approach sk180176

The first time it stuck in the grub boot process (manual power reset required).

However, I tried again sk180176 and it reboots properly. HAsh value was properly in grub.conf.

But navigating into the menu 'Maintenance mode' ended again up with Admin password: Failed!

Thanks

Regards

Re: R81.10 boot menu password

the_rock — Wed, 11 Oct 2023 13:46:19 GMT

I wish I had R81.10 lab to check this, sorry mate. Just curious, what does below show on yours?

Andy

[Expert@CP-TEST-FIREWALL:0]# cd /etc
[Expert@CP-TEST-FIREWALL:0]# ls -lh grub
grub.d/ grub2-efi.cfg grub2.cfg

Re: R81.10 boot menu password

S_E_ — Wed, 11 Oct 2023 14:04:48 GMT

Hi, some output...

b.t.w. it is not a show stopper for anything. I simply wanted to increase the boot partition size to have space for more than 1 snapshot.

Regards

[Expert@SMS:0]# pwd
/etc

[Expert@SMS:0]# ls -lh grub
ls: cannot access grub: No such file or directory
[Expert@SMS:0]#

[Expert@SMS:0]# ls -lh grub*
lrwxrwxrwx 1 admin root 22 Oct 9 06:04 grub.conf -> ../boot/grub/grub.conf

[Expert@SMS:0]# more ../boot/grub/grub.conf
# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE: You have a /boot partition. This means that
# all kernel and initrd paths are relative to /boot/, eg.
# root (hd0,0)
# kernel /vmlinuz-version ro root=/dev/hda2
# initrd /initrd-version.img
#boot=/dev/sda
default=6
timeout=0
hiddenmenu
machine=ST-110-00
menutitle=Gaia R81.10
background 777777
serial --unit=0 --speed=9600 --word=8 --parity=no --stop=1
terminal --silent --timeout=5 console serial
password --encrypted <...REMOVED>
splashimage=(hd0,0)/grub/splash.xpm.gz

title Revert from other image
lock
root (hd0,0)
configfile /grub/submenus/switch_to_backup.lst

title Reset to factory defaults - Gaia R80.10
confirm This will erase the entire configuration. Do you wish to continu
e [no]:
root (hd0,0)
kernel /fcd_GAIA/vmlinuz-x86_64 ro root=/dev/mapper/vg_splat-lv_fcd_GAIA
console=CURRENT restore fcd_GAIA single
initrd /fcd_GAIA/initrd-x86_64

title Reset to factory defaults - Gaia R77.30
confirm This will erase the entire configuration. Do you wish to continu
e [no]:
root (hd0,0)
kernel /fcd_R77.30/vmlinuz-x86_64 ro root=/dev/mapper/vg_splat-lv_fcd_R7
7.30 console=CURRENT restore fcd_R77.30 single
initrd /fcd_R77.30/initrd-x86_64
title Start in 64bit no-debug mode
root (hd0,0)
kernel /vmlinuz-x86_64 ro root=/dev/mapper/vg_splat-lv_current grub_mod
e=64bit-no-debug vmalloc=256M panic=15 console=SERIAL intel_idle.max_cstate=0 e
agerfpu=on spectre_v2=off nopti 3 quiet
initrd /initrd-x86_64

title Start in maintenance mode 64bit
lock
root (hd0,0)
kernel /vmlinuz-x86_64 ro root=/dev/mapper/vg_splat-lv_current vmalloc=2
56M grub_mode=64bit-maintenance panic=15 console=CURRENT eagerfpu=on spectre_v2=
off nopti debug 7 single
initrd /initrd-x86_64

title Start in 64bit online debug mode
root (hd0,0)
kernel /vmlinuz-x86_64 ro root=/dev/mapper/vg_splat-lv_current grub_mod
e=64bit-online-debug vmalloc=256M panic=15 console=tty1 console=CURRENT kgdboc=
kbd,ttyS0 crashkernel=0M-35G:280M,35G-250G:768M,250G-:1G intel_idle.max_cstate=0
eagerfpu=on spectre_v2=off nopti 3
initrd /initrd-x86_64

title Start in 64bit normal mode
root (hd0,0)
kernel /vmlinuz-x86_64 ro root=/dev/mapper/vg_splat-lv_current grub_mod
e=64bit-normal vmalloc=256M panic=15 console=SERIAL crashkernel=0M-35G:280M,35G
-250G:768M,250G-:1G intel_idle.max_cstate=0 eagerfpu=on spectre_v2=off nopti 3 q
uiet
initrd /initrd-x86_64

title HW Diagnostics
root (hd0,0)
kernel /hwdiag/vmlinuz-x86_64 ro vmalloc=256M root=/dev/mapper/vg_splat
-hwdiag panic=15 console=CURRENT 1 rmatool
initrd /hwdiag/initrd-x86_64

Re: R81.10 boot menu password

the_rock — Wed, 11 Oct 2023 14:02:11 GMT

If I had R81.10 clean install, I would be able to compare that file. Sadly, I dont, only R81.20. I checked /boot dir and there is no grub sub-dir, ONLY grub2 and when I go there, I only see grub.cfg file, no grub.conf

Do you have grub.cfg at all?

Andy

Re: R81.10 boot menu password

S_E_ — Wed, 11 Oct 2023 14:07:08 GMT

@the_rock wrote:

Do you have grub.cfg at all?

hi, no

Regards

Re: R81.10 boot menu password

the_rock — Wed, 11 Oct 2023 14:08:46 GMT

K, let me think about this for a moment. Im wondering if I was to install R81.10 in the lab, maybe I could give you the grub.conf file, not sure that would solve your issue, but worth a try?

Andy

Re: R81.10 boot menu password

the_rock — Wed, 11 Oct 2023 14:19:13 GMT

Since I really want to help you here, I will build exact same lab fw with version you have (totally clean, from scratch), slap basic password on it and send you the file once ready.

Please bear with me for a bit, as Im working on some Fortinet stuff, so will do this in parallel.

Andy

Re: R81.10 boot menu password

the_rock — Wed, 11 Oct 2023 16:44:05 GMT

Ok...I built brand new R81.10, installed same jumbo and I attached grub.conf file. Password is abc123!!! if it asks, not sure if it will, if you decide to try replace the file, But, PLEASE, make sure to do backup and also backup the existing grub file before doing any of this.

Btw @S_E_ , as it would not let me attach the original file, since its conf format, I copied the content and attached it as notepad++ format, but I can email you original one if need be.

Andy

Re: R81.10 boot menu password

the_rock — Thu, 12 Oct 2023 13:06:08 GMT

Hey @S_E_

Im on site today, but wanted to check in to see how goes it? Were you able to sort out the issue?

Andy

Re: R81.10 boot menu password

S_E_ — Thu, 12 Oct 2023 15:49:37 GMT

Hi,

Thanks a lot for your help.

I copied your file to my device.

steps:

cd /boot/grub

dos2unix grub.conf.txt

cp grub.conf grub.conf.ORIGINAL

cp grub.conf.txt grub.conf

Rebooted device and tried maintenance mode

Admin password:

abc123!!!

abc123!

abc123

Always same message

Admin password: *********
Failed!
Press any key to continue...

According the missing menu entries "Reset to factory defaults R77.30, Reset to factory defaults R80.10, your file was readable and it worked.

I was also able to run the box into standard 64 bit mode with your file. Normal boot does work.

It simply does not accept the password when trying to enter maintenance mode.

So it must be something different.

But again, thanks for your help.

Regards

Re: R81.10 boot menu password

the_rock — Thu, 12 Oct 2023 16:03:38 GMT

Thats so odd...hm. I just tried it again and worked fine with abc123!!!. As per attached, I simply chose maintenance mode 64 bit mode.

Andy

Re: R81.10 boot menu password

the_rock — Thu, 12 Oct 2023 16:18:54 GMT

I also attempted something else, but sadly nothing : - (. What I did was backup the file (grub.conf) and then edit original grub file, remove password encrypted line, saved, rebooted into maintenance mode, but then it does not even let me click an option to go into maintenance. Once I put all the way it was, lets me log in with abc123!!! password

Sorry mate, Im totally out of ideas 😞

Andy