topic Re: Has anyone gotten around being locked out of Panorama? in General Topics

Has anyone gotten around being locked out of Panorama?

hkp — Thu, 14 Mar 2013 16:24:09 GMT

It appears that my passwords no longer work to get logged into Panorama. It did have an unexpected shutdown and now I cannot login. I found this: but it has been a few days since I restarted again.

Any other suggestions?

Re: Has anyone gotten around being locked out of Panorama?

mharding — Thu, 14 Mar 2013 16:32:07 GMT

What version is your Panorama VM running?

Re: Has anyone gotten around being locked out of Panorama?

hkp — Thu, 14 Mar 2013 16:36:08 GMT

5.0.2

I should have included it.

Re: Has anyone gotten around being locked out of Panorama?

mharding — Thu, 14 Mar 2013 16:54:12 GMT

Are you setup with just local accounts or are you also using authentication through RADIUS/Kerberos/LDAP?

Re: Has anyone gotten around being locked out of Panorama?

hkp — Thu, 14 Mar 2013 17:59:11 GMT

Just local accounts.

Re: Has anyone gotten around being locked out of Panorama?

mharding — Thu, 14 Mar 2013 19:14:04 GMT

This would be the first time I've heard of local accounts being locked out. Are you able to log in at the console?

At any rate, I would report this to Palo Alto Support.

Re: Has anyone gotten around being locked out of Panorama?

hkp — Tue, 19 Mar 2013 14:28:08 GMT

Thanks for help.

Re: Has anyone gotten around being locked out of Panorama?

hkp — Tue, 19 Mar 2013 14:41:06 GMT

Well, support wasn't much help. I was told to use the default admin username and password. That did not work.

I was able to change the admin password by changing the phash value for the admin user in every xml file I could find. Probably not a supported way of doing things, but I got back in.

If a panorama password recovery tool doesn't exist, maybe PaloAlto can try this and give me some credit.

Re: Has anyone gotten around being locked out of Panorama?

mschuricht — Tue, 19 Mar 2013 16:46:11 GMT

Hmm, how were you able to alter the PHASH if you could not log into the Panorama?

Re: Has anyone gotten around being locked out of Panorama?

Quinton — Tue, 19 Mar 2013 17:08:21 GMT

What XML files are you referring to and where are they located?

Re: Has anyone gotten around being locked out of Panorama?

hkp — Tue, 19 Mar 2013 17:39:46 GMT

mschuricht wrote:

Hmm, how were you able to alter the PHASH if you could not log into the Panorama?

Live CD or mount the vmdk to another Linux VM you happen to have running.

Re: Has anyone gotten around being locked out of Panorama?

hkp — Tue, 19 Mar 2013 17:47:15 GMT

quinton wrote:

What XML files are you referring to and where are they located?

On the pancfg volume (sda5) any xml file you can find with phash value in it. I assume that I really only had to edit one, but it was just easier to find them all. It is the same file you get when you export the config.

Re: Has anyone gotten around being locked out of Panorama?

mschuricht — Tue, 19 Mar 2013 18:09:28 GMT

We are glad you were able to resolve the issue.

Editing the Panorama install files directly is a dangerous practice that is not supported or recommended. I would suggest talking to support before going down this avenue in the future. It is unfortunate we were unable to resolve this in your first call.

The admin could have been locked based on too many invalid login attempts. This can happen if the failed attempts limit is hit which can be set under Panorama > Setup > Authentication Settings the lockout period can also be set. To unlock the admins you can go to Panorama > Administrators and click the unlock link.

Re: Has anyone gotten around being locked out of Panorama?

mikand — Tue, 19 Mar 2013 18:31:51 GMT

Ehm... if the admin is locked out from the Panorama - how do you expect the admin to then reach Panorama -> Administrators, or am I missing something here? 😉

Re: Has anyone gotten around being locked out of Panorama?

mschuricht — Tue, 19 Mar 2013 19:34:06 GMT

It seems rare to only have a single user on the Panorama so the suggestion was an assumption that multiple admins existed.

Without multiple admins it sounds like a factory reset is the best option.

It seems like a few precautions may have made the failure recoverable. Eg. have unique admins for each person managing the security device, do not configure a failed attempt lockout with only one admin, configure a lockout time if you configure a failed attempt lockout and especially with only one admin, use scheduled config export to back up the Panorama config so it can be restored if a failure occurs, etc

Re: Has anyone gotten around being locked out of Panorama?

hkp — Tue, 19 Mar 2013 20:26:47 GMT

I did have multiple admins, none were able to log in. Failed attempts and lockout time were/are not configured. I agree with the precautions, and followed all but the scheduled export. I am working on setting that up now since I could have started with a new appliance and pushed my configuration to it. I also agree that is a better plan than what I resorted to.

Re: Has anyone gotten around being locked out of Panorama?

mharding — Wed, 20 Mar 2013 14:58:57 GMT

That's interesting.

Along time ago (PAN-OS 2) I was having problems with a config, one of the Palo Alto Engineers was able to login as root on my 2050 and alter the running-config file. That's interesting if that same functionality doesn't exist in Panorama.