Lost admin password and SIC between staging and deployment

[Vladimir]

Hello everyone.

I have run into a situation that one of the cluster members moved between staging environment to production is no longer allowing me to log in using admin password and there is no longer SIC between it and the management.

Since in staging there was no Syslog server, I have no record of the changed for that unit.

I strongly suspect that the client, for some reason, rerun FTW on that gateway, but no means of confirming that.

I still have LOM access to the unit.

Any suggestions on how to:

1. Reset the Gaia password using LOM (if possible)

2. Retrieve Gaia logs showing what was done on the unit.

The only prove that it was in a good state at some point are the old successful policy installation records in the audit logs.

I still have snapshots, backups and Gaia configs from the unit when it was in a good state and may attempt to recover from those.

Any suggestions on how to accomplish that using LOM console are appreciated.

Thank you,

Vladimir

[the_rock]

I dont believe you can reset regular Gaia pw using LOM, at least, I never heard of such a possibility. As far as audit logs, do you see anything in /var/log/audit dir?

Andy

[Vladimir]

@the_rock , if I could read the /var/log/audit directory, I would be logged-in to the unit in question:)

There are few SKs describing boot from alternate media to reset the password, but to the best of my recollection they are referring to USB drives. I will be looking at the unit tomorrow again to see if there is option to mount remote USB bootable media via LOM to attempt the recovery.

Was wandering if anyone has run into similar situations already.

[the_rock]

I realized my stupidity in audit comment as soon as I posted it, DUH : - ). Sorry mate, my bad. K, lets see if anyone may have ran into something similar.

Let us know how it gets solved.

Andy

[Vladimir]

No problem:)

I'd like to make a suggestion for Check Point to include preconfigured alternative bootable image (CentOS or Ubuntu, if I am not mistaken) in LOM boot from options to facilitate the recovery in these or similar situations.

[Bob_Zimmerman · Accepted solution]

You can feed the LOM's KVMS interface an ISO image, which it will then present to the system as a DVD in a DVD-ROM drive connected via USB. It is possible to boot from this drive.

Reads from this virtual drive are streamed over the network, so they're pretty high-latency. They can actually perform worse than a real optical drive does. I recommend using a small live CD without a GUI. The CentOS minimal or NetInstall versions should work.

[Vladimir]

Thank you @Bob_Zimmerman ! I'll give it a shot.

[the_rock]

Thanks for sharing @Vladimir 

[Vladimir · Accepted solution]

Just an update to put this issue to rest: for some unexplainable reason, authentication is now working and SIC was re-established. I suspect that there was some weird combination of networking issue and Zoom interference with keystrokes path-through at play, since there is nothing in the logs except failed logon attempts.