Has anyone gotten around being locked out of Panorama?

[hkp]

It appears that my passwords no longer work to get logged into Panorama.  It did have an unexpected shutdown and now I cannot login.  I found this: but it has been a few days since I restarted again.

Any other suggestions?

[mharding]

What version is your Panorama VM running?

[hkp]

5.0.2

I should have included it.

[mharding]

Are you setup with just local accounts or are you also using authentication through RADIUS/Kerberos/LDAP?

[hkp]

Just local accounts.

[mharding]

This would be the first time I've heard of local accounts being locked out. Are you able to log in at the console?

At any rate, I would report this to Palo Alto Support.

[hkp]

Thanks for help.

[hkp · Accepted solution]

Well, support wasn't much help.  I was told to use the default admin username and password.  That did not work.

I was able to change the admin password by changing the phash value for the admin user in every xml file I could find.  Probably not a supported way of doing things, but I got back in.

If a panorama password recovery tool doesn't exist, maybe PaloAlto can try this and give me some credit. 

[mschuricht]

Hmm, how were you able to alter the PHASH if you could not log into the Panorama?

[Quinton]

What XML files are you referring to and where are they located?

[hkp]

mschuricht wrote:

Hmm, how were you able to alter the PHASH if you could not log into the Panorama?

Live CD or mount the vmdk to another Linux VM you happen to have running.

[hkp]

quinton wrote:

What XML files are you referring to and where are they located?

On the pancfg volume (sda5) any xml file you can find with phash value in it.  I assume that I really only had to edit one, but it was just easier to find them all.  It is the same file you get when you export the config.

[mschuricht]

We are glad you were able to resolve the issue.

Editing the Panorama install files directly is a dangerous practice that is not supported or recommended. I would suggest talking to support before going down this avenue in the future. It is unfortunate we were unable to resolve this in your first call.

The admin could have been locked based on too many invalid login attempts. This can happen if the failed attempts limit is hit which can be set under Panorama > Setup > Authentication Settings the lockout period can also be set. To unlock the admins you can go to Panorama > Administrators and click the unlock link.

[mikand]

Ehm... if the admin is locked out from the Panorama - how do you expect the admin to then reach Panorama -> Administrators, or am I missing something here? 😉

[mschuricht]

It seems rare to only have a single user on the Panorama so the suggestion was an assumption that multiple admins existed.

Without multiple admins it sounds like a factory reset is the best option.

It seems like a few precautions may have made the failure recoverable. Eg. have unique admins for each person managing the security device, do not configure a failed attempt lockout with only one admin, configure a lockout time if you configure a failed attempt lockout and especially with only one admin, use scheduled config export to back up the Panorama config so it can be restored if a failure occurs, etc