Unable to Login to Gateway

[LostBoY]

Hi,

We are running a cluster environment with 2 gateways...suddenly one of the gateways is not accepting the passwords, i am sure we are using the correct passwords as we can use them to login to the other member of the cluster. Also sure that the passwords haven't been changed.

Any help as to what might have occurred and how to set a new password through R80.10 Smartconsole.

Thanks

[G_W_Albrecht]

Please explain: Which version you are using and where the passwords are not accepted anymore - we can think of console port, SSH or GAiA WebGUI. For GAiA OS passwords, it is not possible to set a new password through R80.10 Smartconsole. But there is a solution:sk92663: Reset the Gaia Admin and Expert passwords using EmergenDisk USB flash drive

[LostBoY]

Hi,

Thanks for the reply.

Using Gaia R80.10 , both the members are in VSX cluster , unable to login through ssh.

Is it possible that the passwords have expired ? if so is there a way to cross check it through smart console ?

[G_W_Albrecht]

Please open an SR# with TAC - VSX is a very complicated environment that i do have no hands-on experiences with (and glad about that)...

[Matthias_Haas]

Hi,

may be this is an option: How to remotely reset Admin / Expert password on a Security Gateway from a Security Management Serve... (sk106490)

Matthias

[G_W_Albrecht]

Yes, sk106490 looks very good - but still, this is VSX, and i do not know how e.g. VSLS will influence this. I would rather contact TAC before risking to render the VSX instable...

[Timothy_Hall]

Is the gateway still reporting an OK status in SmartConsole?  Can you still push policy to it?  If not the box may have a shortage of memory, which keeps sshd from successfully spawning your shell process (clish/bash) after successfully verifying your password.  This effect can look very similar to an incorrect password.

--

CheckMates Break Out Sessions Speaker

CPX 2019 Las Vegas & Vienna - Tuesday@13:30

[LostBoY]

Status is OK in SmartConsole, can push policy as well.

Its just that suddenly its not accepting all the user account passwords.

[Matthias_Haas]

you could use "cprid_util" for further troubleshooting from the Mng Server, e.g.

cprid_util -server 192.168.42.11 -verbose rexec -rcmd bash -c "df -k" 

for checking the free disk space or the following for getting the content of the secure log file:

cprid_util -server 192.168.42.11 -verbose rexec -rcmd bash -c "cat /var/log/secure"

Run these commands on the Mng Server and replace the IP with your VSX Gateway Mng IP.

see sk101047 for further details.

[LostBoY]

Hi,

NEW DEVELOPMENT : So one of the user who is also an admin is able to login to the device, when he tries to create a new user id the password is coming in plain text , is it possible that the hash is corrupted ? if so how can this be corrected ?

[LostBoY]

Hi,

NEW DEVELOPMENT : So one of the user who is also an admin is able to login to the device, when he tries to create a new user id the password is coming in plain text , is it possible that the hash is corrupted ? if so how can this be corrected ?

[LostBoY]

The issue is resolved.

Problem was the hash were corrupted, copied them from the other gateway and everything is working fine now.