topic Hi, Try username as root and in Network Security

SourceFire now FireSIGHT?

zackgil861 — Tue, 12 Mar 2019 12:47:42 GMT

I have the SourceFire appliance in my network. The previous network admin did not leave any password for this device. I am unable to get into it or reset the PW. I tried the below, it reset it like it shows, but still no luck getting in via GUI or console. Is there anything else I can do? I also tried instead of the passwd i tried passwd admin but it gives an error saying username not found. Can anyone help out?

SW Version 4.9

1) Power cycle your appliance by pressing the reset button. Refer to the Sourcefire 3D Sensor Installation Guide in the Hardware Specifications section for the model of your appliance for the location of the reset button.

2) At the Lilo prompt type:

3D-4.9.0 init=/bin/sh

—> The system will boot in to shell prompt;

3)Mount the linux drive.

mount -o remount,rw /

4) After you mount the drive type

passwd

Hi,Try following this article

Aastha Bhardwaj — Wed, 21 Oct 2015 23:12:31 GMT

Hi,

Try following this article and see if that helps:

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118631-technote-firesight-00.html

Also send the snapshot of the exact error.

Regards,

Aastha

I dont know what is happening

zackgil861 — Thu, 22 Oct 2015 14:40:57 GMT

I dont know what is happening. I was looking at a webpage yesterday that had the instruction on how to reset the password but i can no longer find the page. The instructions you provided are not working. When I reboot the system and press the arrow at LILO, I enter (3D-4.9.0 single) and the reboot but it dosen't boot to the menu where I can enter the configs. I found a page yesterday that said to type 3D-4.9.0 single and some more and then reboot. I can't find the page today which is really starting to get to me.

Alright I found it, see the

zackgil861 — Thu, 22 Oct 2015 14:55:09 GMT

Alright I found it, see the attached, i took a screenshot. As you can see whenI type "passwd admin" it's not taking. When I type passwd and then type the password, it takes it but i still can't get in with the new password

so to get in to this config by the way I go though these steps.

- I boot the system and press the arrow at LILO

- I type 3D-4.9.0 init=/bin/sh and reboot

- then I type mount -o remount,rw /

- and then I reset my pw

In 4.9,Hi,Once your appliance

Aastha Bhardwaj — Thu, 22 Oct 2015 18:10:03 GMT

Hi,

Once your appliance starts booting up, cancel the countdown at the LILO Boot Menu by pressing any key on your keyboard

3D-4.9.0 init=/bin/sh

--> The system will boot in to shell prompt;

Mount the linux drive.
mount -o remount,rw /

After you mount the drive type
passwd

And then you should be able to change the password.Apparently the command passwd admin was introduced in 4.10.

Let me know if that works.

Regards,

Aastha

Rate the post if it helps!!!!

I did that and i was able to

zackgil861 — Thu, 22 Oct 2015 18:17:30 GMT

I did that and i was able to change it. What I dont understand is what I am changing the password for? Once I reboot the system after the password change, I sitll can't get in with the username "admin" and the new password

Hi, Try username as root and

Aastha Bhardwaj — Thu, 22 Oct 2015 18:17:31 GMT

Hi,

Try username as root and you should be able to login.

Regards,

Aastha

that worked!! How can I reset

zackgil861 — Thu, 22 Oct 2015 18:25:43 GMT

that worked!! How can I reset the password for the 3D senors in GUI via the console? Or atleast create new username and password for GUI sensor access

Ok, so i actually configured

zackgil861 — Thu, 22 Oct 2015 18:50:58 GMT

Ok, so i actually configured an IP on thr device.

configure-network

I assigned 10.153.0.19 IP to it. Once I was done, it gave me a message:

"Please go to https://10.153.0.19 to finish installation"

But when I go there, all I get is a all blank screen.

Any advice?

Hi, Check the connectivity .

Aastha Bhardwaj — Thu, 22 Oct 2015 19:35:15 GMT

Hi,

Check the connectivity . Try pinging the default g/w from the device and so on.

Once that is confirmed , we might need to check for httpsd errors

Escalate the privilege to root.

admin>sudo su
Password>Enter root password

Pmtool status | grep httpsd

You can try to restart the service : “pmtool restartbyid httpsd”

Also check:

++ cd /var/log/httpd
++ls –l
++ more httpsd_access_log

I would definately recommend you to upgrade the device from 4.9 to latest because its already EOL.

Regards,

Aastha

Rate if it helps!!!!

thanks, i only get this root

zackgil861 — Thu, 22 Oct 2015 19:42:43 GMT

thanks, i only get this

root@Sourcefire3D:~# sudo su
root@Sourcefire3D:~#
root@Sourcefire3D:~#
root@Sourcefire3D:~# sudo
usage: sudo -h | -K | -k | -L | -l | -V | -v
usage: sudo [-bEHPS] [-p prompt] [-u username|#uid] [VAR=value]
{-i | -s | <command>}
usage: sudo -e [-S] [-p prompt] [-u username|#uid] file ...

Also whats really confusing

zackgil861 — Thu, 22 Oct 2015 19:46:19 GMT

Also whats really confusing is i found some notes from previous admin and I found another IP for the sourcefire. I entered it to the webpage, and the 3D sensor login came up. Is that something else? It does say ":sourcefire" but when I went to the SSH, it only shows the IP i configured not the one in the admins notes. The username and password either way doesn't work there

Hi, Oh that is to become a

Aastha Bhardwaj — Thu, 22 Oct 2015 19:48:39 GMT

Hi,

Oh that is to become a root user and I see you are already root so you should be able to execute the commands given.

Check the pmtool status for httpsd service and see if its running , try to restart it and check for any errors .

Regards,

Aastha

i tried but it's not taking

zackgil861 — Thu, 22 Oct 2015 19:50:42 GMT

i tried but it's not taking the commands

root@Sourcefire3D:~# pmtool restartbyid httpsd
sh: pmtool: command not found
root@Sourcefire3D:~# pmtool restartbyid httpsd
sh: pmtool: command not found
root@Sourcefire3D:~#
root@Sourcefire3D:~#
root@Sourcefire3D:~#
root@Sourcefire3D:~# pmtool status
sh: pmtool: command not found
root@Sourcefire3D:~# Pmtool status | grep httpsd
sh: Pmtool: command not found

Hi , Try pmtool status |grep

Aastha Bhardwaj — Thu, 22 Oct 2015 19:59:42 GMT

Hi ,

Try pmtool status |grep -i Down or Pmtool status | grep httpd or just pmtool status to see if the service is running or not.

There could be multiple issues because the version that you are on is very old .I would recommend you to upgrade it and if you still face issues open up a case with TAC , because they might need to check the Tshoot.

Regards,

Aastha

how do I upgrade this thing?

zackgil861 — Thu, 22 Oct 2015 20:40:37 GMT

how do I upgrade this thing? Will it drop my network? I have been rebooting via console and nothing was happeing

Hi, Probably you can upgrade

Aastha Bhardwaj — Thu, 22 Oct 2015 21:29:17 GMT

Hi,

Probably you can upgrade to 4.10 and then migrate from 4.10. Check the link : https://support.sourcefire.com/sections/1/sub_sections/53

The migration guide is present in there or if this is brand new device then you can reimage the device. For reimage :

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118308-technote-firesight-00.html#anc4

Regards,

Aastha

If I upgrade the device, will

zackgil861 — Thu, 29 Oct 2015 14:35:50 GMT

If I upgrade the device, will I lose any of the configs on it? Since I dont have access ot the gui, I dont want to upgrade and then find out I got no configs.

Hi,

Aastha Bhardwaj — Thu, 29 Oct 2015 17:45:17 GMT

Hi,

Ideally the upgrade does not lead to config loss.So if you follow the upgrade path then it should not happen. Though we always recommend that you should have a backup of your config always.

Regards,

Aastha Bhardwaj

Rate if that helps!!!