Checkpoint Endpoint Security Ubuntu: Resetting the Admin Password

When managing Checkpoint endpoint security on an Ubuntu-based system, administrators often need to reset the admin password for troubleshooting or other purposes. This article provides a step-by-step guide on how to reset the admin password in a Checkpoint VM running on Ubuntu.

To begin with, ensure that you have access to the server console, either through SSH or Gaia Portal using the default credentials (username: admin and password: admin). If your server is behind a proxy server, configure it according to the instructions provided below.

Next, reboot the Checkpoint VM by entering the command `reboot` in the console. After the reboot, unmount the Gaia filesystem by running the command `umount /mnt/cp`. Then, exit the chroot environment and return to Ubuntu using the command `exit`.

To update the database and change the admin password, you will need to use SQLite. First, connect to the Gaia configuration database using the command `sqlite3 /config/db/initial_db`. This will open a SQLite prompt where you can execute queries.

Backup the current Gaia configuration database by running the command `cp /config/db/initial_db /config/db/initial_db_backup`. Then, change the root directory to the Gaia root by executing the command `chroot /mnt/cp`.

Mount the Gaia filesystem using the command `mount /dev/mapper/vg_splat-lv_current /mnt/cp`, and then select the 'Try Ubuntu' option to boot into a live environment without installing Ubuntu.

Configure the Checkpoint VM to use a recent Ubuntu Desktop ISO and boot from CD-ROM. This will allow you to access the system's file system and reset the admin password.

To reset the admin password, update the database using SQLite by executing the following command:

`UPDATE revisions SET value='$1$zIVyrIdj$1LBW7Pg6XOcXYIgFPTppY.' WHERE binding='passwd:admin:passwd' AND VALUE='old-pw-hash';`

Replace `old-pw-hash` with the last hash from step 9. Then, query the database using SQLite to locate the current admin password:

`SELECT * FROM revisions WHERE binding='passwd:admin:passwd';`

After resetting the admin password, you can log in to the system using the new password.

It's worth noting that this procedure was successfully tested on R80.10 and allows for a more robust and secure method of resetting the admin password compared to manually editing OS files like `/etc/passwd` or `/etc/shadow`. Additionally, this article provides a solution for situations where booting from USB is not possible due to VMware guest restrictions.

By following these steps, administrators can easily reset the admin password on their Checkpoint endpoint security system running on Ubuntu.

Checkpoint endpoint security ubuntu