Tag: Checkpoint

Posted on

Checkpoint: How To Reset “expert” Mode Password On SecurePlatform

This article describes how to reset the expert mode password on SecurePlatform for your Checkpoint appliance or open server.

For Open Servers

Obtain the live linux distribution Knoppix. You can download the current version from the Knoppix website: http://www.knoppix.net

1. Boot the machine from the Knoppix CD – you can use a built-in CD/DVD drive or an external one.

2. Once the desktop appears, click on the icon to open a terminal window, the run the following commands. See also the “Notes” section below.

$ su
# mkdir /checkpoint
# mount /dev/hda2 /checkpoint
# mount /dev/hda1 /checkpoint/boot
# chroot /checkpoint
# /bin/expert_passwd

3. At this point you are prompted to enter a password – type in the new password twice.

4. To change the regular cpshell admin users’s password:

# passwd admin

You are prompted to enter a password.

Type in the new password twice.

5. Run the “exit” and then the “reboot” command.

6. Remove the Knoppix CD and boot normally.

You can now log in as the user ‘admin’ and log in to Expert mode with each of the new passwords you just assigned.

———————

Notes for Point 2:

If the mount /dev/hda2/checkpoint command fails, use the following command instead:

/dev/hda3/checkpoint

If the system has SATA drives then use the following command:

mount /dev/sda8 /checkpoint and /dev/sda2 /checkpoint/boot

An easy way to find drive mappings is to use gparted from Knoppix “K menu” > system > gparted.

Knoppix will not let you run this unless you have root and a password for root.

To create valid passwords use sudo passwd, i.e.

# sudo passwd root

You need to mount the root partition on /checkpoint, and the boot partition on /checkpoint/boot

———————

For UTM-1 Appliances *AND* Open Servers

1. Obtain the Red Hat boot CD. (The current Fedora Core boot CD will as also work).

2. At the boot prompt, boot from the Red Hat boot CD with the following command: “linux rescue ”

3. When prompted, answer the questions presented by the boot process.

4. The system is mounted on the hard drive, and its location is indicated. Write down the system location (which should be: /mnt/sysimage/, or /mnt/sysimage/).

5. When the command prompt is displayed again, edit the following file (Vi editor should be available): /mnt/sysimage/boot/grub/grub.conf

Find the line that looks like this:

password --md5 <a bunch of scrambled numbers, letters, and symbols>

Add a ‘#‘ at the very beginning of that line. It should then look like this:

#password --md5 <a bunch of scrambled numbers, letters, and symbols>

6. Find a line that opens with the word ‘lock‘ and add a ‘#’ at the very beginning of that line.

7. Save and exit the editing session.

8. Reboot the machine.

9. Remove the boot CD from the CD-ROM drive before it boots from the CD (again).

10. When the following prompt appears:

GRUB … (the dots increase in number until it boots the default kernel)

Press the ‘Space‘ key. This should display the GRUB menu.

11. Select the line that has the word ‘Maintenance‘ in it and press ‘Enter‘ key.Note: if this step fails to boot into the Maintenance mode, do the following:

Select the line that contains ‘maintenance‘ and press ‘e‘ key.You are allowed to edit the GRUB options for this boot option.

  • Press ‘b‘ key to boot this option.
  • SecurePlatform boots until a prompt similar to the following appears:sh-bash 2.0.5#
  • Change the passwords for:
    • A user, like ‘admin‘, run:
      \ passwd admin
    • For Expert mode, run:
      /bin/expert_passwd
  • Reboot.

 

 

 

Related posts:

Posted on

Checkpoint: Best Practice Kernel Parameters for ClusterXL Stability

This article details how to configure the best practice kernel parameters to ensure ClusterXL stability.

It is recommended to set ALL of those values on your cluster – also see sk92723 on Cluster flapping prevention.

Make sure the changes to the kernel parameters are performed on both members!

To test (will not survive a reboot):

fw ctl set int fwha_freeze_state_machine_timeout 200
fw ctl set int fwha_policy_update_timeout_factor 3
fw ctl set int fwha_pnote_timeout_mechanism_monitor_cpu 1
fw ctl set int fwha_pnote_timeout_mechanism_cpu_load_limit 80
fw ctl set int fwha_if_connectivity_tolerance 3

Once you are happy with the above you can enter the values into the $FWDIR/boot/modules/fwkern.conf file to make sure that the parameters stick after a reboot.

If the fwkern.conf doesn’t exist create it using the “touch” command:

[Expert@fw-trinity:0] # touch $FWDIR/boot/modules/fwkern.conf

Using the vi editor, insert the below commands into the fwkern.conf file:
fwha_freeze_state_machine_timeout = 200
fwha_policy_update_timeout_factor = 3
fwha_pnote_timeout_mechanism_monitor_cpu = 1
fwha_pnote_timeout_mechanism_cpu_load_limit = 80
fwha_if_connectivity_tolerance = 3

Related posts:

Posted on

Checkpoint: Using “dmidecode” to Find the Appliance Model of a UTM-1

This article details how to use “dmidecode” to find out your Checkpoint UTM-1’s model number.

Dmidecode reports information about your system’s hardware as described in your system BIOS according to the SMBIOS/DMI standard  – see here for a sample output.

This information typically includes system manufacturer, model name, serial number, BIOS version, asset tag as well as a lot of other details of varying level of interest and reliability depending on the manufacturer. This will often include usage status for the CPU sockets, expansion slots (e.g. AGP, PCI, ISA) and memory module slots, and the list of I/O ports (e.g. serial, parallel, USB).

This also works on a number of linux-based operating systems including (but not limited to):

  • Linux i386, x86-64, ia64
  • FreeBSD i386, amd64
  • NetBSD i386, amd64
  • OpenBSD i386, amd64
[Expert@fw-trinity:0]# /usr/sbin/dmidecode | grep "Product Name"
Product Name: U-5-00

Here is the Product Name dmidecode table for the UTM-1/Power-1 appliances:

DMI Code: Model of UTM:
C2_UTM UTM-1 450 Appliance
C6P_UTM UTM-1 2050 Appliance
C6_UTM UTM-1 1050 Appliance
P-10-00 Power-1 5070 Appliance
P-20-00 Power-1 9070 Appliance
U-10-00 UTM-1 270 Appliance
U-15-00 UTM-1 570 Appliance
U-20-00 UTM-1 1070 Appliance
U-30-00 UTM-1 2070 Appliance
U-40-00 UTM-1 3070 Appliance
U-5-00 UTM-1 130 Appliance

Related posts: