SourceFire now FireSIGHT?

[zackgil861]

I have the SourceFire appliance in my network. The previous network admin did not leave any password for this device. I am unable to get into it or reset the PW. I tried the below, it reset it like it shows, but still no luck getting in via GUI or console. Is there anything else I can do? I also tried instead of the passwd i tried passwd admin but it gives an error saying username not found. Can anyone help out?

SW Version 4.9

1) Power cycle your appliance by pressing the reset button. Refer to the Sourcefire 3D Sensor Installation Guide in the Hardware Specifications section for the model of your appliance for the location of the reset button.

2) At the Lilo prompt type:

3D-4.9.0 init=/bin/sh

—> The system will boot in to shell prompt;

3)Mount the linux drive.

mount -o remount,rw /

4) After you mount the drive type

passwd

[zackgil861]

If I upgrade the device, will I lose any of the configs on it? Since I dont have access ot the gui, I dont want to upgrade and then find out I got no configs.

[Aastha Bhardwaj]

Hi,

Ideally the upgrade does not lead to config loss.So if you follow the upgrade path then it should not happen. Though we always recommend that you should have a backup of your config always.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

[zackgil861]

Also whats really confusing is i found some notes from previous admin and I found another IP for the sourcefire. I entered it to the webpage, and the 3D sensor login came up. Is that something else? It does say ":sourcefire" but when I went to the SSH, it only shows the IP i configured not the one in the admins notes. The username and password either way doesn't work there

[zackgil861]

Alright I found it, see the attached, i took a screenshot. As you can see whenI type "passwd admin" it's not taking. When I type passwd and then type the password, it takes it but i still can't get in with the new password

so to get in to this config by the way I go though these steps.

- I boot the system and press the arrow at LILO

- I type 3D-4.9.0 init=/bin/sh and reboot

- then I type mount -o remount,rw /

- and then I reset my pw