PASSWOR|D RECOVERY FOR IDS

[haseeb_eng]

I want to do password recovery for the IDS 4210. I had read the process in which it requires a bootable disk and a CD . Disk software i can download from the web but i am confused about CD , which solaris operating system CD we should use ? and i am not sure which ids operating system is running in this IDS .

The commands mentioned in the process should i use them as it is ?

[zihussai]

Hi Haseeb,

--The CD that you need to insert is the IDS Uprade/Recoevry CD

--The recovery method defined in the link below is good for all the IDS devices running 3.x. I think it should be good for IDS 4.0 too as the Release notes for 4.0 does not talk about the difference..

http://www.cisco.com/warp/public/474/34.html

Hope the above will help

Thanks

Zia

[jplatzer]

The recovery method described above will only work for pre-4.0 versions.

The Solaris boot disk cannot be used to recover passwords for 4.0 since version 4.0 uses the Linux operating system. There is currently no password recovery mechanism for version 4.0.

[kleem]

If you are runing CIDS 4.0 and have lost the password, your only option is to reimage the Sensor. You can do this by booting the Recovery CD or by electing to boot the Recovery Partition while booting the Sensor. In either case, this will completely erase the current contents of the Sensor. You will have to create new accounts. If you are using the IDS MC to manage the box, you can push down the stored configuration and be back up and running.

[DSmirnov]

It is easy to modify Linux boot parameters, boot sensor in single user mode and reset root password...

Doesn't help much BTW, since there are no nice text files with configuration anymore... but for example we usually use sensors as sniffers if something happend.

However I think in case of support call Cisco will ask you to reimage the sensor if password is changed ...

[ywadhavk]

The Solaris CD you are reffering to is to be procured from Sun. SunOS 5.8

This is kind of a very round-about method. The best method is as per the other posts here, re-image the box using the recovery CD, rebuilt the config or use the management utility (IDSMC or CSPM) to push the config out to the sensor.

Hope this helps.

Thanks,

yatin

[haseeb_eng]

Thankyou everybody for your help . I will do it from the method described in the link which you provide me but i wana ask you that the mentioned in this method should i use them as it is ? i.e if i can copy and paste these commands into IDS during the password recovery process will it give any surprise problem ?i am not good in solaris thats why not fully aware of its commands

[ywadhavk]

This procedure is a tested one, so you should not have any problems adopting it as-is. But its better to have the recovery CD handy in case things go south.

Thanks,

yatin