How to reset smart-1 6000L idrac admin password

[Hongyu_Chen]

Hi,

We have a smart-1 6000L appliance.  I lost the password for idrac admin user. 

In the log, it shows a password for admin has been generated, but I don't recall I have done that. 

[Expert@host:0]# more /var/log/cp_idrac.log
[04/17/23@11:33:57]:in idrac_set_user_password user=admin
[04/17/23@11:33:57]:in idrac_set_user_password user_id = 2 user=admin
New password was generated successfully for iDRAC admin user..
[04/17/23@12:32:08]:in idrac_set_user_password user=admin
[04/17/23@12:32:09]:in idrac_set_user_password user_id = 2 user=admin
New password was generated successfully for iDRAC admin user..

I tried admin/admin but no luck.

I have also tried this command "SetiDRACUser" to reset the password but seems it can only change password for user id range between 3-16, while admin's id is 2. 

[Expert@host:0]# SetiDRACUser
Enter User ID: 2
Enter User name: admin
Enter Password:
Enter Password again:
Error:User ID Should be in the range [3-16]
Set new user failed, See /var/log/cp_idrac.log
[Expert@host:0]#

Below is the output of the log:

Starting: Set iDRAC User
[05/08/23@11:56:45]:in idrac_set_user_password_enforce user=admin
[05/08/23@11:56:45]:Error:User ID Should be in the range [3-16]
[05/08/23@11:56:45]:User ID validation failed

How do I reset the idrac admin password?

Thanks. 

[AkosBakos]

Hi,

Have you tried to upgrade the LOM? Maybe it flashes the current settings, the you can use # lomipset.

Akos

[Hongyu_Chen]

Hi Akol,

I upgraded the idrac firmware per your suggestion, still no luck. 

Regards,

[AkosBakos]

Hi,

Have you tried the #ipmetool command?

Reset the whole LOM card:

https://support.checkpoint.com/results/sk/sk127573

[Expert@HostName:0]# ipmitool raw 0x2e 0x02

Otherwise, I think it is time to involve the TAC.

Akos

[the_rock]

Yup, what @AkosBakos gave you is a solution (also per below link)

https://community.checkpoint.com/t5/Security-Gateways/LOM-password-reset-on-5600-and-12400-appliance...

Cheers,

Andy

[Hongyu_Chen]

Thanks Andy, Akos for your prompt reply. 

Following command works for me. 

ipmitool user set password 2 vpn123

Regards,

[the_rock]

If thats your new LOM password, dont worry, we wont tell anyone ; - )

Just kidding...happy it worked mate, good job! 👍

Andy

[eladni · Accepted solution]

Hi, 

Access to iDRAC is supported only with operator user.
Admin user is not supported nor recommended by Check Point
Note that any reboot of the system will reset the admin user and password.

[the_rock]

Never heard that before...I recall last year I was on phone with TAC Tier 3 and we used admin account and they never mentioned anything about it. Is there an sk or somewhere stating this?

Andy

[eladni]

Please see https://support.checkpoint.com/results/sk/sk122914 under known limitations:
[ Access to iDRAC is available only with restricted operator user ]

[the_rock]

Maybe TAC never mentioned anything as client was using 6200, so I dont see that model listed in the sk.

Andy

[Hongyu_Chen]

Hi,

I just rebooted the machine and the admin user still exist. 

[the_rock]

Cant say Im surprised, I would not think reboot would ever get rid of that account. 

Andy

Plus this -> Access to iDRAC is available only with restricted operator user.

Does NOT even give issue ID. so logically tells me that sk should be updated.

[eladni]

Admin  user and password will *reset* after reboot.

[the_rock]

@eladni Does not sound like that happens at all... @Hongyu_Chen can you confirm?

Andy

[Hongyu_Chen]

admin password was not reset after reboot. 

[the_rock]

Thats what I thought as well, tx for confirming. @eladni , thats why I said sk is wrong and should be updated. Apologies if Im misunderstanding something...

Andy

[eladni]

HI, regarding the reboot/reset - thanks for the input, we will check it internally and update.

Nevertheless, the SK mentioned admin user is not supported.
It will not be supported so no required changes in SK at the moment.

Thanks

[the_rock]

Ok, fair enough 🙂