Monthly Archives: August 2012

Reset your ASA5505 Password

If you have forgotten the password to access your ASA configuration or need to perform maintenance on an ASA device but do not have administrative access, this process will guide you through the steps that are necessary to recover the password to administer it.  You must be physically connected to the device for this method to work.  In my case, I am directly consoled to the device through a serial cable connection and using PuTTY to reach into the device itself.

  • Reboot the device.  While it is powering up, press the escape key to enter ROMMON.
  • To tell the device to ignore its normal configuration when the device is reloaded enter the following while in ROMMON:

rommon #0> confreg

You will see the current configuration register (normally 0×00000001) and will be prompted to to change its value.  Be sure to make note of the register value so you can change it back later, when you are finished making changes.

  • Enter Y at the “Do you wish to change this configuration?” prompt to change the register value.
  • Accept the defaults (you don’t not need to specify Y/N, the default is already picked for you, simply hit enter to accept) for all settings except the “disable system configuration?” setting, select Y at this prompt as depicted below.

  • Reload the ASA to have it pick up the changes you just made.

rommon #0> boot

You should now be able to access the ASA by typing “en” to get to enable mode and then “conf t” to enter global config mode.  From here you can paste in the config file you would like to use or simply change the password so you can administer the device as you normally would.

hostname(config)# password password
hostname(config)# enable password password
hostname(config)# username name password password

Finally, to exit out of ROMMON and have the ASA boot with its normal startup configuration, enter “confreg” value, where value is the previously noted registry value we recorded, 0×1.  If you have trouble finding the usage or syntax of this command type “help” to well, help you.

rommon #1> confreg 0×1

Followed by a reload, as pictured below.

The ASA should boot up normally now and you should be able to go about your business without any further complications.  Let me know if you know of any easier or better ways of resetting passwords for ASA devices.

Resources:
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/trouble.html#wp1049302

Protip August: Quickly Determine Linux System Info

If you have ever found yourself in a situation where you are looking at a foreign Linux OS you know how handy it is to know exactly what type of system you are dealing with.  Practically all modern flavors of Linux offer the following commands to quickly determine important information about a particular system.

lsb_release -a

This command is handy for obvious reasons.  It quickly tells you what OS version you are looking at.  As you can see it looks like my OS is a little bit out of date. :)

uname -a

This one is handy for quickly obtaining kernel information as well as generic OS info (OS, platform, etc).

Update (11/1/12)

I just found another way to gather the OS version quickly from the command line using the venerable cat command.  The syntax for the command is as follows.

cat /etc/issue

Sweet!  This is handy if you are only concerned with looking up the OS and version you are working.

 

Adjust Exchange 2010 Mailbox Quotas

I just wanted to make a note of this because it is easy to do via the Exchange Management Shell but can become problematic through the EMC, especially with a large number of mailbox databases.  Essentially what we are looking to do here is change the default warning and prohibit limits that Exchange uses for user mailboxes.

The following command will change the warning size to 7GB and prohibit users the ability to send messages at 8GB.

Get-MailboxDatabase | Set-MailboxDatabase -issuewarningquota 7gb -prohibitsendquota 8gb

And we can double check our handy work through the EMC to make sure that we have these properties adjusted properly.

Everything looks good.  I should note that there are a number of other really handy things that can be changed via the set-mailboxdatabse cmdlet and the ability to pipe it through get-mailboxdatabase is fairly straight forward, making global changes to your Exchange environment such as this one much quicker and easier to do. There is some good reading here:

http://technet.microsoft.com/en-us/library/bb123971.aspx
http://technet.microsoft.com/en-us/library/dd297937.aspx