password

9 Topics

Ansible - Bricking freshly installed vcmp guests with ansible
Hello fellow F5 admins, currently I try to establisheda workflow, where new vcmp guests are created and configured with a standard basic config (and even building a HA setup). The creation part is working, but here begin the problems: tl;dr Question: What is the properway to bootstrap a freshly installed vcmp guests(or appliance), when you are forced to change the default passwords on 1st login, without doing it by hand? The only solution I found (link below) will lock me out of the system forever. Long Version: Freshly installed systems enforce a password change for admin user on 1st access. This password change cannot be accomplished with the standard ansible module "bigip_user". If you try, you will get an error telling you, password has expired and it has to be changed. I then found an article about the security password policy and how one is supposed to change the password with ansible (https://techdocs.f5.com/en-us/bigip-14-0-0/big-ip-system-secure-password-policy/secure-password-policy-chapter-title.html) So I gave it a try and the password was changed "a" password, but not the one provided by the playbook variable. Neither GUI nor SSH or REST login will work. I am locked out. Befor you ask: yes the password in ansible-vault style is correct, because it is used to create the guest on the vcmp hosts. Here is my playbook: --- - name: Test vCMP-Guest hosts: vcmp_guests gather_facts: false vars: f5_api_admin_user: admin f5_api_admin_password: !vault | $ANSIBLE_VAULT;1.1;AES256 35613438373864653838386266616364666366363332646635303036343266646664656333643932 6462363934306365636265313038376436353032303330370a656434643837343165316333393932 66616133376433303136366664303563373034353630656531663864323433663166653539303937 3937646663613064390a663631623733376339353735633362633139383635386661376137653434 6237 bigip_provider: server: "{{ ansible_host }}" server_port: 443 user: "{{ f5_api_admin_user }}" password: "{{ f5_api_admin_password }}" validate_certs: false transport: rest tasks: - name: Set admin Password uri: url: "https://{{ ansible_host }}/mgmt/shared/authz/users/admin" method: PATCH body: '{"oldPassword":"admin","password":"{{ f5_api_admin_password }}"}' body_format: json validate_certs: false force_basic_auth: true user: admin password: admin headers: Content-Type: "application/json" register: result delegate_to: localhost - name: Debug ansible.builtin.debug: var: result - name: Try to get system info f5networks.f5_modules.bigip_device_info: gather_subset: - system-info provider: "{{ bigip_provider }}" register: output delegate_to: localhost - name: Debug ansible.builtin.debug: var: output The Output of the the passwordreset task look fine to me: TASK [Debug] ******************************************************************************************************************************************************************************** task path: ~/guest-playbook.yml:47 ok: [test-guest] => { "result": { "cache_control": "no-store, no-cache, must-revalidate", "changed": false, "connection": "close", "content_length": "330", "content_security_policy": "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:; img-src 'self' data: http://127.4.1.1 http://127.4.2.1", "content_type": "application/json; charset=UTF-8", "cookies": {}, "cookies_string": "", "date": "Fri, 29 Sep 2023 11:48:50 GMT", "elapsed": 0, "expires": "-1", "failed": false, "json": { "displayName": "Admin User", "encryptedPassword": "<removed>", "generation": 0, "kind": "shared:authz:users:usersworkerstate", "lastUpdateMicros": 0, "name": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "selfLink": "https://localhost/mgmt/shared/authz/users/********", "shell": "/sbin/nologin" }, "msg": "OK (330 bytes)", "pragma": "no-cache", "redirected": false, "server": "Jetty(9.2.22.v20170606)", "status": 200, "strict_transport_security": "max-age=16070400; includeSubDomains", "url": "https://<removed>/mgmt/shared/authz/users/********", "x_content_type_options": "nosniff", "x_frame_options": "SAMEORIGIN", "x_xss_protection": "1; mode=block" The next task, will already fail with a "unauthorized" message. From now on, I cannot access the system any more, and believe me, I tried a lot. One interesting Thing: When I don't use a ansible-vault encrypted password and instead set the variable directly to the string, login is possible, BUT only to the GUI. I cannot do rest api calls with this password. When I change the admin password again (from within GUI), I can however use rest api again. When I change it back to the original one, api calls will fail. There is one difference I noticedin /var/log/audit in the case, when I set the password as clear-text: User authentication is logged like this and the api request fails: AUDIT - user admin - RAW: httpd(pam_audit): User=admin tty=(unknown) After setting a new password within the GUI oder tmsh and running the same api request, audit messaged changed like this and the request is successfull: [...] AUDIT - user admin - RAW: rest(pam_audit): user=admin(admin)[...] When I now change the password back to the previous one, api request fails again [...]AUDIT - user admin - RAW: httpd(pam_audit): User=admin tty=(unknown)[...] What on earth is going on? How is one supposed to bootstrap a vcmp guest from ground up without manually interaction for setting passwords and stuff? Any usefull advice isthoroughly appreciate. Cheers Ichnafi
Solved
Ichnafi
Oct 02, 2023 Place Technical Forum
812Views
0likes
3Comments
16.0.1 LTM OVA Login
Hi folks, Apologies for the simple question. I've downloaded the BIG-IP LTM 16.0.1-0.0.3 ova and installed it on ESXi 7. It's there no problems, I can log into the cli with root/default, give it a management address that I can browse to, but I can't log into the gui with admin/admin. I've tried resetting the admin password with tmsh modify auth user admin prompt-for-password and save sys config but I still can't log in and get auth failed in the secure log. What am I missing?!? Best, Leigh
Solved
LH
Jun 05, 2023 Place Technical Forum
490Views
1like
1Comment
Python/Bigsuds: change_my_password does not work for guest user
Hi, I'd like to change the password of a user with guest permissions on a BIG-IP v10.2.4 using python with bigsuds. Although the login is successful (I can get a list of pools etc.), Management.UserManagement.change_my_password exits with an error: ServerError: Server raised fault: 'Exception caught in Management::urn:iControl:Management/UserManagement::change_my_password() Exception: Common::OperationFailed primary_error_code : 17238053 (0x01070825) secondary_error_code : 0 error_string : 01070825:3: Access denied - Administrators only: User (guestuser) is not an Administrator and must supply the old password.' How can I either supply the old password or change my password any other way? Thanks in advance Lukas
Lukas_145238
Jun 02, 2023 Place Technical Forum
335Views
0likes
2Comments
APM: Show errormessage if AD password change failed
Hi, i got a request today to display an errormessage if the password change for an AD account failed. I thougt this would be default, but somehow there is no info/message shown, just the two texfields for the new password and the verification are cleared. In the apm-log shows up a message "AD module: change password for 'asdf' failed: Password change rejected(4), result_string: (4)" How can i display an info like "sorry, your password couldnt be changed because it is to short/weak, please use at least 512 characters, a primenumber and the blood from an virgin goat" Best regard
mwi
Oct 07, 2022 Place Technical Forum
548Views
0likes
1Comment
iRules LX for APM password reset
We are attempting to use APM as a Self-Service Password Reset resolution. I can modify Active Directory attributes than to this article https://devcentral.f5.com/s/articles/apm-cookbook-modify-ldap-attribute-values-using-iruleslx-21850 , however, has anyone used iRules LX to reset a password. I'll validate the user first with other methods but want to reset a forgotten password rather than the APM built-in Kerberos API reset with the current password to update to a new one. Thanks
Dan_E
Nov 02, 2021 Place Technical Forum
835Views
1like
1Comment
Login page user name and password visible in Browser.
We have Public website, where we manage authentication for users. During Our Audit we found, Username and password are visible in logs of browser. We need hide it for all users. Do we have option in F5 AWAF?
IRONMAN
Jul 07, 2021 Place Technical Forum
756Views
0likes
1Comment
APM - password expiry warning
Is there any way to warn users of pending password expiration? Thanks!
Munney
Jun 10, 2019 Place Technical Forum
372Views
0likes
3Comments
F5 LTM root account missing.
I tried the default password and it didn't work. Then I went using GUI admin account to System => Platform and the whole section for Root account under "Administration accounts" is missing. Any ideas?
logical_254756
Mar 02, 2017 Place Technical Forum
290Views
0likes
2Comments
Unable to change admin/root pwd
I have a new 3600 staged and ready to go. However I need to change the admin password. Currently the only interface that is up is the management interface. I have attempted to change the password from the GUI, TM shell, and BP all with the same response. BIGpipe unknown modification error: 01070733:3: Incorrect password or you may not change your password yet. Failed to change user's password. Exiting. Any ideas on why this is occurring and what I need to do to correct it? Thanks,
STORN69_148037
Sep 03, 2014 Place Technical Forum
364Views
0likes
2Comments