CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. Come to CPUG CON 2008 EUROPE in Switzerland on September 8th - 9th!
    Two days full of technical content for Check Point administrators in the beautiful Swiss Alps!
    We've already had our first sign-ups!
2. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting 6/9, 7/14, 8/25, 10/6, 11/3, 12/8.
3. We have new forums in Portuguese and German (see below).
4. Corrent S3500 SecureXL Turbocards For Sale - Last Six Remaining - Get Your Spares!
5. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Check Point Firewall-1/VPN-1 And Related Products > Disaster Recovery
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2008-02-29
prasanth_ch prasanth_ch is offline
Junior Member
 
Join Date: 2008-02-29
Posts: 4
prasanth_ch has an average reputation (10+)
Default password recovery on R61

HI,

Can anybody please let me know the instructions about how to recover password for R61 on Splat operating system.

Regards,
Prasanth.Ch
Reply With Quote
  #2 (permalink)  
Old 2008-02-29
Danielpb Danielpb is offline
Senior Member
 
Join Date: 2006-10-23
Posts: 131
Danielpb has an average reputation (10+)
Default Re: password recovery on R61

I came accoss this but not 100% it will work....

==========================

boot from a live linux cd, mount up the / partition and edit the /etc/shadow file and removing the root password method myself.

An example mount command once you boot from the cdrom (your root device may be different):
mount -o remount,rw /dev/sda8 /mnt

Just edit /mnt/etc/shadow to remove the password field: move to just beyond the first ":" and remove everything up to the next ":". With vi, that would be "/:" to move to the first ":", space bar once, then "d/:" and ENTER. You'll get a warning about changing a read-only file; that's normal. Before you do this, /mnt/etc/shadow might look like:

root:$1$8NFmV6tr$rT.INHxDBWn1VvU5gjGzi/:12209:0:99999:7:-1:-1:1074970543
bin:*:12187:0:99999:7:::
daemon:*:12187:0:99999:7:::
adm:*:12187:0:99999:7:::

and after, the first few lines should be:

root::12209:0:99999:7:-1:-1:1074970543
bin:*:12187:0:99999:7:::
daemon:*:12187:0:99999:7:::
adm:*:12187:0:99999:7:::

You'll need to force the write: with vi, ":wq!". Then reboot and eject the cd and try accessing expert with a blank password
Reply With Quote
  #3 (permalink)  
Old 2008-03-09
Tommo Tommo is offline
Junior Member
 
Join Date: 2007-02-23
Posts: 20
Tommo has an average reputation (10+)
Default Re: password recovery on R61

Recovering a Forgotten SPLAT Password
1. If you know the Expert Mode password, but not any of the user passwords,
go to Maintenance Mode. The Expert Mode password is also used to access
Maintenance Mode. Once in Maintenance Mode, issue the cpshell command. Use
the adduser command to create a new user, whose password is known. If you
don't have the option of creating a new user, you're probably stuck
following the steps for when you know neither the Standard Mode nor the
Expert Mode password (see #3 below).
2. If you know a user's Standard Mode password, but you've forgotten the
Expert Mode password, things get a little trickier, but not too bad. I used
a bootable Linux distro (tested with Knoppix & F.I.R.E.).
a) boot to CD
b) mount the hard disk ( mount /dev/hda2 /mnt/hda2 )
c) edit the SecurePlatform passwd file - change the user's default shell
from cpshell to bash (see tip above)
d) boot to SecurePlatform & login with the user you just modified; you get a
bash prompt
e) use the passwd command to change the Expert Mode password
f) edit passwd & change the user's default shell back to cpshell
I tested this using a special user created for the test and also with admin.
No problems either way.
3. If you don't know the Standard Mode password and you don't know the
Expert Mode password, things are even trickier, but you can still get in.
You'll need access to another SecurePlatform installation and a bootable
Linux distro for this one.
a) go to a SecurePlatform box where you know the passwords
b) copy the /etc/passwd and /etc/shadow files to a floppy
c) go to the SecurePlatform machine where you don't know the passwords and
boot to your bootable Linux CD
d) mount the hard disk and the floppy with passwd and shadow files
e) move the existing passwd and shadow files to .old
f) copy the passwd and shadow files from the floppy to your SecurePlatform
machine
g) edit passwd and change the user's default shell from cpshell to bash
h) boot to SecurePlatform and login using the user you just modified; you
get a bash prompt. You may also get an error message if the user doesn't
have a home directory - you should still be able to login
i) use the passwd command to change the Expert Mode password
j) edit /etc/passwd & change the user's default shell back to cpshell
I also changed the permissions on passwd & shadow to match their original
permissions. For passwd, the original permissions were 644. For shadow, the
original permissions were 400.
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT -7. The time now is 11:13.


Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
LinkBacks Enabled by vBSEO 3.0.0