Reset your ASA5505 Password

If you have forgotten the password to access your ASA configuration or need to perform maintenance on an ASA device but do not have administrative access, this process will guide you through the steps that are necessary to recover the password to administer it.  You must be physically connected to the device for this method to work.  In my case, I am directly consoled to the device through a serial cable connection and using PuTTY to reach into the device itself.

  • Reboot the device.  While it is powering up, press the escape key to enter ROMMON.
  • To tell the device to ignore its normal configuration when the device is reloaded enter the following while in ROMMON:

rommon #0> confreg

You will see the current configuration register (normally 0×00000001) and will be prompted to to change its value.  Be sure to make note of the register value so you can change it back later, when you are finished making changes.

  • Enter Y at the “Do you wish to change this configuration?” prompt to change the register value.
  • Accept the defaults (you don’t not need to specify Y/N, the default is already picked for you, simply hit enter to accept) for all settings except the “disable system configuration?” setting, select Y at this prompt as depicted below.

  • Reload the ASA to have it pick up the changes you just made.

rommon #0> boot

You should now be able to access the ASA by typing “en” to get to enable mode and then “conf t” to enter global config mode.  From here you can paste in the config file you would like to use or simply change the password so you can administer the device as you normally would.

hostname(config)# password password
hostname(config)# enable password password
hostname(config)# username name password password

Finally, to exit out of ROMMON and have the ASA boot with its normal startup configuration, enter “confreg” value, where value is the previously noted registry value we recorded, 0×1.  If you have trouble finding the usage or syntax of this command type “help” to well, help you.

rommon #1> confreg 0×1

Followed by a reload, as pictured below.

The ASA should boot up normally now and you should be able to go about your business without any further complications.  Let me know if you know of any easier or better ways of resetting passwords for ASA devices.

Resources:
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/trouble.html#wp1049302

About the Author: Josh Reichardt

Josh is the creator of this blog, a system administrator and a contributor to other technology communities such as /r/sysadmin and Ops School. You can also find him on Twitter and Facebook.

Protip August: Quickly Determine Linux System Info

If you have ever found yourself in a situation where you are looking at a foreign Linux OS you know how handy it is to know exactly what type of system you are dealing with.  Practically all modern flavors of Linux offer the following commands to quickly determine important information about a particular system.

lsb_release -a

This command is handy for obvious reasons.  It quickly tells you what OS version you are looking at.  As you can see it looks like my OS is a little bit out of date. :)

uname -a

This one is handy for quickly obtaining kernel information as well as generic OS info (OS, platform, etc).

Update (11/1/12)

I just found another way to gather the OS version quickly from the command line using the venerable cat command.  The syntax for the command is as follows.

cat /etc/issue

Sweet!  This is handy if you are only concerned with looking up the OS and version you are working.

 

About the Author: Josh Reichardt

Josh is the creator of this blog, a system administrator and a contributor to other technology communities such as /r/sysadmin and Ops School. You can also find him on Twitter and Facebook.

Adjust Exchange 2010 Mailbox Quotas

I just wanted to make a note of this because it is easy to do via the Exchange Management Shell but can become problematic through the EMC, especially with a large number of mailbox databases.  Essentially what we are looking to do here is change the default warning and prohibit limits that Exchange uses for user mailboxes.

The following command will change the warning size to 7GB and prohibit users the ability to send messages at 8GB.

Get-MailboxDatabase | Set-MailboxDatabase -issuewarningquota 7gb -prohibitsendquota 8gb

And we can double check our handy work through the EMC to make sure that we have these properties adjusted properly.

Everything looks good.  I should note that there are a number of other really handy things that can be changed via the set-mailboxdatabse cmdlet and the ability to pipe it through get-mailboxdatabase is fairly straight forward, making global changes to your Exchange environment such as this one much quicker and easier to do. There is some good reading here:

http://technet.microsoft.com/en-us/library/bb123971.aspx
http://technet.microsoft.com/en-us/library/dd297937.aspx

About the Author: Josh Reichardt

Josh is the creator of this blog, a system administrator and a contributor to other technology communities such as /r/sysadmin and Ops School. You can also find him on Twitter and Facebook.

Use Windows Backup to Truncate Logs in Exchange 2010 with DAG Configuration

I ran into a few minor glitches that weren’t mentioned in other posts when using this method in my own environment.  So first I will mention what was different for me, then I will be going over the full set of instructions to use this method.  My goal for this post is to be as thorough and unambiguous as possible so there are no questions after reading these instructions.

First, it wasn’t readily apparent what specifically needed to be backed up in the pieces I read.  Though, it is quite possible I managed to misread the sections that described them.  After some experimentation in our test network I learned that all volumes containing databases and log files need to be backed up.  This means that if you have separate drives for logs and databases, both of them need to get backed up, I would have saved a lot of time had I known this beforehand.  And, as far as I can tell, both the mailbxes and logs have to be backed up for this method to work, not just one or the other.  So just to reiterate this with an example, you have to back both the (L:) and (M:) volumes up.

The other thing that was mentioned in other posts but wasn’t clear cut was the need to change the registry key to disable VSS trasnport replication.  It is necessary for Exchange environments using a DAG configuration with both active and passive databases, if this change isn’t the case the backup may work but your logs won’t get truncated.  Finally, ensure that you have the Microsof Exchange Server Extension for Windows Backup service started.

  • Log on to the server by using an account that has local administrator access, and open regedit
  • Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\ExchangeServer\v14\Replay\Parameters.
  • Add a new DWORD value named EnableVSSWriter, and set its value to 0.
  • Exit Registry Editor and then restart the Microsoft Exchange Replication service.

Okay, now we need to enable the Windows Backup feature (I will leave that to the reader), just make sure not to enable the backup command line tools (they are outdated).

So now you just create your backup job and after everything is all said and done your logs should get truncated, it seems like a lot more work than should be necessary but if your logs don’t get truncated then really bad things happen, so it is a small price to pay I guess to make sure things are working the right way.

That’s pretty much it.  Once the backup has completed your log volume should have more room.  There are other ways to clear the transaction logs, maybe I will go over them in another post but this method is (for the most part once you figure out what you’re doing) easy and built into Windows.  Just make sure you have enough free space somewhere on your network to house the backups, especially if there there is a lot to move.

About the Author: Josh Reichardt

Josh is the creator of this blog, a system administrator and a contributor to other technology communities such as /r/sysadmin and Ops School. You can also find him on Twitter and Facebook.

An Easy Way to Synchronize your Passwords

I have a lot of passwords.  Like, somewhere in the range of 50 or so for various work stuff, email, home server, websites, etc.  I don’t know about anybody else, but I can’t remember that many passwords let alone keep track of which ones change or expire.  In this post I will be going over a way to keep passwords centralized in one place, secure and available to me whenever I need them (for the most part).  On top of that this is a great way to keep all of your passwords up date easily.  Because I am always creating new accounts or changing existing account passwords this is essentially the best way that I have found to do it over the years.

It is a fairly simple idea in practice so let’s get going.  You will need a few things first.  Download and install Dropbox on any and all of the computers that you will want to view/edit or create username and passwords on.  I like Dropbox because it works cross platform so I can sync my folders on a Linux, Android iOS or Mac OS system like I would on a Windows box, which is pretty handy.  Oh yeah, and its free.

Next we are going to need to go get a program called KeePassX.  This is what actually keeps track of your passwords.  This project was spawned originally from KeePass.  One very nice feature is that the password database files are compatible across programs so if you don’t like KeePassX you can check out KeePass and everything will just work, and vice versa, going from KeePass to KeePassX.  I like this program because like Dropbox it is cross platform, reliable, free (Open Source), has some pretty handy features and is super easy to use.

Ok sweet, now that we have the tools we need it is just a matter of getting up and going.  Not a lot of configuration but there are a few steps.  The first is to make a home for you password file and your encryption key (if you want to use two factor authentication) inside Dropbox. I made a folder called “keepassx” to put my crypto key, “keepassx” and my password file “passwords.kdb” in there.

But we need to create these files with KeePassX before we can put them in our Dropbox folder.  Easy enough, most of these should be pretty much self explanatory so if I miss something let me know.

So this is the screen you get when you open up KeePassX by default.  If you already have your password file created just enter your master password and your key file (encryption key) if you created one to open up your password list.  If this is the first time opening the program choose a master password and decide if you want to use an encryption key.  The encryption key, should you choose to make one, will be one of the files that goes into your Dropbox folder to be synchronized.

NOTE: The password pictured above is your master password and should be chosen carefully.  It should be unique, have as many unique characters and as much entropy as possible if you want your password file to be as secure as possible.

Once you have created your password/encryption, the rest is easy.  Take a spin, create some password entries, build a few groups whatever you want just so we can get some data into the password database.  Then just save your file and choose the path to  Dropbox that you chose.

Now from whatever other device you would like to access this from just open KeePassX, enter your password and browse to the location you set for your password file.

About the Author: Josh Reichardt

Josh is the creator of this blog, a system administrator and a contributor to other technology communities such as /r/sysadmin and Ops School. You can also find him on Twitter and Facebook.