Details
All versions of SP.
This was seen on VSP - 6.0.3.0.3.
Also may happen on VSP R6.4
Problem Clarification
System Platform: Cannot log into CDOM via SSH nor web, but can log into Dom0 via SSH.
Customer may forget the password for admin and root, or the account is locked for too many failure login.
Cause
The LDAP cert may have expired.
Run the following command to determine whether the LDAP certificates are valid
openssl x509 -text -in /etc/openldap/cacerts/cdom.crt|egrep -i 'Not Before|Not After'
Not Before: Sep 29 11:50:31 2011 GMT
Not After : Sep 26 11:50:31 2021 GMT
It may have been generated on Jan 1, 2002 because that is the default date on an S8300d if shipped from a factory. The LDAP expiry date for 10 years brings the expiry date to Dec 30, 2011. This will break LDAP.
Above describe the scenario on LDAP cert is expired on VSP, the other scenario listed as below (Please note it applied to VSP R6..0.3 ~ R6.4. For the version < VSP R6.0.3, please raise ticket to reach Avaya Backbone Team for support):
Customer may forget the password for admin and root
The account is locked for too many failure login.
Give the general handling procedure here:
1) Open putty, Login to CDOM or Dom0 as init (here I suppose we log into cdom and suppose customer forgot the admin password)
2) Use ASG tool to get the login password for init.
3) After init login, run su - sroot to switch to sroot (also use ASG tool to get password)
3) Run command pam_tally to check if the account is locked for toom many failure login (If pam_tally does not exist, please try pam_tally2. Replace pam_tally to pam_tally2 in step below if you meet the warning here).
4) You can use pam_tally --reset to clear all failure login record, then run the command pam_tally to check the result (Please note there are 2 '-' before reset)
5) Now, use command ssh dom0.vsp to log into Dom0 as user sroot (or you can use ssh
sroot@dom0.vsp, They are same)
6) Repeat step 3 and 4 to clear the failure login on dom0
7) Run command service ldap status to check if ldap process is runing OK. if it is dead, please run command service ldap restart to start it. (If ldap service does not exist, please use slapd to replce ldap. please noe the ldap service is on Dom0, so you must run the command on Dom0)
If the cert is expired, please run command ldap_cert_updater to renew the LDAP certificate.
9) Run command passwd admin to reset admin password (after resetting password you may need 2~5 min to wait for the password takes effect. )
10) Run command passwd root to reset root password
Note:
dom0.vsp is equal to the IP address of Dom0. That is defined in hosts file in CDOM.
cdom0.vsp is defined in the hosts file on Dom0, equal to the IP address of cdom
admin account is controlled by LDAP database, can be used for logining CDOM/DOM0 CLI, and the CDOM webpage. so you may need to wait for 2~5 min for it takes effect.
root account is the linux local account, so the password takes effect immediately.
)
0:0:root:/root:/bin/bash