Thursday, January 28, 2016

Password Recovery

netscaler password recovery procedure

Summary

This document describes how to perform a Password Recovery procedure for the NetScaler device running 6.0 and 6.1.

Procedure

Follow these steps to perform a Password Recovery procedure:

Note: Refer to the transcript in the More Information section for a complete listing of commands and output.

   1. Attach a console cable to the NetScaler Serial Console (9600 baud, 8 bits, 1 stop bit, No parity).
   2. Boot the NetScaler system.
   3. The following message is seen:

      Hit [Enter] to boot immediately, or any other key for command prompt
      Booting [kernel] in 10 seconds
      Press the SPACEBAR.
      Note: If using the NetScaler 7000 press CTRL+C here.

   4. Type boot –s.

      This starts the kernel in single user mode.

   5. You should see the message:

      Enter full pathname of shell or RETURN for /bin/sh:
      Press ENTER.
      Note: The prompt now changes to \u@\h\$.

   6. Check disk consistency by typing the following:

      \u@\h\$ /sbin/fsck /dev/ad0s1a
      Note: Be sure to include a space between /sbin/fsck and /dev/ad0s1a.

   7. Type df to view mounted partitions, then enter the following command to mount the flash drive:

      \u@\h\$ /sbin/mount /dev/ad0s1a /flash
      Note: Be sure to include spaces between /sbin/mount, dev/ad0s1a, and /flash.
      If this command fails, you can create the flash directory before issuing the mount by typing the following command:
      \u@\h\$ mkdir /flash
      Now retry the mount command. You can also type df again to view the mounted drives.

   8. Type the following command:

      \u@\h\$ cd /flash/nsconfig

   9. Type the following commands to rewrite the ns.conf file and remove the set system command defaulting to the nsroot user:

      \u@\h\$ grep –v “set system user nsroot” ns.conf > new.conf
      Rename the old ns.conf:
      \u@\h\$ mv ns.conf old.ns.conf

      Rename the new.conf file to ns.conf:
      \u@\h\$ mv new.conf ns.conf

  10. Reboot the NetScaler device by typing the reboot command.
  11. You can now log on using the following credentials:

      User name: nsroot
      Password: nsroot

  12. Change the nsroot password once you have logged on by typing the following command:

      > set system user nsroot 

More Information

This is a transcript of the Password Recovery procedure.


Console: serial port
BIOS drive C: is disk0
BIOS drive D: is disk1
BIOS 637kB/1046500kB available memory

FreeBSD/i386 bootstrap loader, Revision 0.8
(murray@builder.FreeBSD.org, Tue Sep 18 10:05:43 PDT 2001)
Loading /boot/defaults/loader.conf
ns-6.1-86.1 text=0x4b6260 data=0x64908d0+0x5b50f4


Hit [Enter] to boot immediately, or any other key for command prompt.

Booting [kernel] in 2 seconds...

Type '?' for a list of commands, 'help' for more detailed help.
ok boot –s

Copyright (c) 1992-2003 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 4.9-NETSCALER-6.1 #0: Tue Dec 6 00:52:06 PST 2005

build@amber.netscaler.com:/usr/obj/usr/home/build/rs_61/usr.src/sys/NETSCALER
Calibrating clock(s) ...



Mounting root from ufs:/dev/md0c
da0 at ahc0 bus 0 target 0 lun 0
da0: Fixed Direct Access SCSI-3 device
da0: Serial Number 3JA9380Z00007453SCPE
da0: 160.000MB/s transfers (80.000MHz, offset 63, 16bit), Tagged Queueing Enabled
da0: 35003MB (71687372 512 byte sectors: 255H 63S/T 4462C)
md0: invalid primary partition table: no magic
start_init: trying /sbin/init
Enter full pathname of shell or RETURN for /bin/sh:
\u@\h\$
\u@\h\$ /sbin/fsck /dev/ad0s1a
ad0s1: type 0xa5, start 32, end = 500735, size 500704 : OK
** /dev/ad0s1a
** Last Mounted on /flash
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check Reference Counts
** Phase 5 - Check Cyl groups
7594 files, 178477 used, 64114 free (7250 frags, 7108 blocks, 3.0% fragmentation)

***** FILE SYSTEM MARKED CLEAN *****
\u@\h\$ /sbin/mount /dev/ad0s1a /flash
ad0s1: type 0xa5, start 32, end = 500735, size 500704 : OK
\u@\h\$ cd /flash/nsconfig
\u@\h\$ df
Filesystem 1K-blocks Used Avail Capacity Mounted on
/dev/md0c 100750 86088 12648 87% /
/dev/ad0s1a 242591 178477 44707 80% /flash
\u@\h\$ grep -v "set system user nsroot" ns.conf > new.conf
\u@\h\$ mv ns.conf old.ns.conf
\u@\h\$ mv new.conf ns.conf
\u@\h\$ reboot
Waiting (max 60 seconds) for system process `vnlru' to stop...stopped
Waiting (max 60 seconds) for system process `bufdaemon' to stop...stopped
Waiting (max 60 seconds) for system process `syncer' to stop...stopped

syncing disks...
done
Uptime: 17m53s
Rebooting...


Hit [Enter] to boot immediately, or any other key for command prompt.

Booting [kernel] in 2 seconds...
Booting [kernel] in 1 second...
Booting [kernel]...



Feb 28 20:15:40 12.178.35.81 02/28/2006:20:15:35 GMT ns : EVENT STATECHANGE : Device "self node 12.178.35.81" - State UP

nssyslog nsvpnlog daemon

nsconmsg:Netscaler Syslog Daemon Starting....

nsconmsg:Netscaler Syslog Daemon Starting....

Displaying accesslogs information
Performance Data Record Version 2.0
Started
Feb 28 20:15:52 ns netscaler: self node 12.178.35.81: UP

login: nsroot
Password:
Last login: Tue Feb 28 13:33:47 from 195.153.38.125
Done


configuring link aggregate channels

> add channel LA/1
 Done
> bind channel LA/1 1/8
 Done
> show channel LA/1
1)      Interface LA/1 (802.3ad Link Aggregate) #9
        flags=0x1004000 
        MTU=1514, native vlan=1, MAC=02:d0:68:15:fd:3b, downtime 0h00m00s
        Requested: media NONE, speed NONE, duplex NONE, fctl NONE,
                 throughput 0
        Actual: throughput 0
        LA mode: MANUAL, distribution: Conn: ENABLED, MAC: BOTH
                1/8: unknown                    DOWN 162h40m02s

        RX: Pkts(0) Bytes(0) Errs(0) Drops(0) Stalls(0)
        TX: Pkts(0) Bytes(0) Errs(0) Drops(0) Stalls(0)
        NIC: InDisc(0) OutDisc(0) Fctls(0) Stalls(0) Hangs(0) Muted(0)
        Bandwidth thresholds are not set.

 Done
>

to configure a vlan by using the netscaler command line

Type the following commands to create a VLAN, bind interfaces to it, verify the configuration, and display the statistics. If you have already created the VLAN, skip the first command.
  • add vlan
  • bind vlan [-ifnum ]
  • show vlan []
Example
> add vlan 2
 Done
> bind vlan 2 -ifnum 1/8
 Done
> show vlan 2

1)      VLAN ID: 2
        Member Interfaces : 1/8         Tagged: None
 Done
>
> stat vlan 2
VLAN ID 2Rate (/s)                                     Total
Packets received                                   0                    0
Bytes received                                     0                    0
Packets sent                                       0                    0
Bytes sent                                         0                    0
Packets dropped                                   --                    0
Broadcast pkts sent & received                    --                    0
 Done
>

configuring network interfaces

set interface 1/8 -duplex full
 Done
> show interface 1/8
        Interface 1/8 (Gig Ethernet 10/100/1000 MBits) #2
        flags=0x4000 
        MTU=1514, native vlan=1, MAC=00:d0:68:15:fd:3d, downtime 162h01m03s
        Requested: media UTP, speed AUTO, duplex FULL, fctl OFF,
                 throughput 0

        RX: Pkts(0) Bytes(0) Errs(0) Drops(0) Stalls(0)
        TX: Pkts(0) Bytes(0) Errs(0) Drops(0) Stalls(0)
        NIC: InDisc(0) OutDisc(0) Fctls(0) Stalls(0) Hangs(0) Muted(0)
        Bandwidth thresholds are not set.

 Done

enabling and disabling mac-based forwarding mode

enable ns mode mbf
 Done
> show ns mode

        Mode                           Acronym              Status
        -------                        -------              ------
 1)     Fast Ramp                      FR                   ON
 2)     Layer 2 mode                   L2                   OFF
 .
 .
 .
 6)     MAC-based forwarding           MBF                  ON
 .
 .
 .
 Done
> 

> disable ns mode mbf
 Done
> show ns mode

        Mode                           Acronym              Status
        -------                        -------              ------
 1)     Fast Ramp                      FR                   ON
 2)     Layer 2 mode                   L2                   OFF
 .
 .
 .
 6)     MAC-based forwarding           MBF                  OFF
 .
 .
 .
 Done
>

enabling and disabling layer 2 or 3 mode

  • enable ns mode
  • disable ns mode
  • show ns mode
Examples
> enable ns mode l3
Done
> show ns mode
Mode                           Acronym              Status
——-                        ——-              ——
1)     Fast Ramp                      FR                   ON
2)     Layer 2 mode                   L2                   OFF
.
.
.
9)     Layer 3 mode (ip forwarding)   L3                   ON
.
.
.
Done
>
> disable ns mode l3
Done
> show ns mode
Mode                           Acronym              Status
——-                        ——-              ——
1)     Fast Ramp                      FR                   ON
2)     Layer 2 mode                   L2                   OFF
.
.
.
9)     Layer 3 mode (ip forwarding)   L3                   OFF
.
.
.
Done

binding the ssl policy to an ssl vserver

  • bind ssl vserver -policyName
  • show ssl vserver
Example
> bind ssl vserver Vserver-SSL-1 -policyName Policy-SSL-1
Done
> show ssl vserver Vserver-SSL-1
Advanced SSL configuration for VServer Vserver-SSL-1:
DH: DISABLED
Ephemeral RSA: ENABLED          Refresh Count: 0
Session Reuse: ENABLED          Timeout: 120 seconds
Cipher Redirect: ENABLED
SSLv2 Redirect: ENABLED
ClearText Port: 0
Client Auth: DISABLED
SSL Redirect: DISABLED
Non FIPS Ciphers: DISABLED
SSLv2: DISABLED SSLv3: ENABLED TLSv1: ENABLED
1)      CertKey Name: CertKey-SSL-1 Server Certificate
1)      Policy Name: Policy-SSL-1
Priority: 0
1)      Cipher Name: DEFAULT
Description: Predefined Cipher Alias
Done
>

creating ssl policies

  • show ssl policy
Example
> add ssl policy Policy-SSL-1 -rule ns_true -reqaction Action-SSL-OWA
Done
> show ssl policy Policy-SSL-1
Name: Policy-SSL-1      Rule: ns_true
Action: Action-SSL-OWA  Hits: 0
Policy is bound to following entities
1)      PRIORITY : 0
Done

creating an ssl action to enable owa support

  • add ssl action -OWASupport ENABLED
  • show SSL action
> add ssl action Action-SSL-OWA -OWASupport enabled
Done
> show SSL action Action-SSL-OWA
Name: Action-SSL-OWA
Data Insertion Action: OWA
Support: ENABLED
Done

binding an ssl certificate key pair to the vserver

  • bind ssl vserver -certkeyName
  • show ssl vserver
Example 
> bind ssl vserver Vserver-SSL-1 -certkeyName CertKey-SSL-1
Done
> show ssl vserver Vserver-SSL-1
Advanced SSL configuration for VServer Vserver-SSL-1:
DH: DISABLED
Ephemeral RSA: ENABLED Refresh Count: 0
Session Reuse: ENABLED Timeout: 120 seconds
Cipher Redirect: ENABLED
SSLv2 Redirect: ENABLED
ClearText Port: 0
Client Auth: DISABLED
SSL Redirect: DISABLED
Non FIPS Ciphers: DISABLED
SSLv2: DISABLED SSLv3: ENABLED TLSv1: ENABLED
1) CertKey Name: CertKey-SSL-1 Server Certificate
1) Cipher Name: DEFAULT
Description: Predefined Cipher Alias
Done

adding a certificate key pair

  • add ssl certKey -cert [-key ]
  • show sslcertkey
Example 
> add ssl certKey CertKey-SSL-1 -cert ns-root.cert -key ns-root.key
Done
> show sslcertkey CertKey-SSL-1
Name: CertKey-SSL-1 Status: Valid,
Days to expiration:4811 Version: 3
Serial Number: 00 Signature Algorithm: md5WithRSAEncryption Issuer: C=US,ST=California,L=San
Jose,O=Citrix ANG,OU=NS Internal,CN=de fault
Validity Not Before: Oct 6 06:52:07 2006 GMT Not After : Aug 17 21:26:47 2022 GMT
Subject: C=US,ST=California,L=San Jose,O=Citrix ANG,OU=NS Internal,CN=d efault Public Key Algorithm: rsaEncryption Public Key
size: 1024
Done

binding services to the ssl vserver

  • bind lb vserver
  • show lb vserver
Example 
> bind lb vserver vserver-SSL-1 SVC_HTTP1
Done
> show lb vserver vserver-SSL-1 vserver-SSL-1 (10.102.29.50:443) – SSL Type:
ADDRESS State: DOWN[Certkey not bound]
Last state change was at Tue Jun 16 06:33:08 2009 (+174 ms)
Time since last state change: 0 days, 00:31:53.70
Effective State: DOWN Client Idle
Timeout: 180 sec
Down state flush: ENABLED Disable Primary Vserver On Down :
DISABLED No. of Bound Services : 1 (Total) 0 (Active)
Configured Method: LEASTCONNECTION Mode: IP Persistence: NONE Vserver IP and
Port insertion: OFF Push: DISABLED Push VServer: Push Multi Clients: NO Push Label Rule:
1) SVC_HTTP1 (10.102.29.18: 80) – HTTP
State: DOWN Weight: 1
Done

adding an ssl-based vserver

  • add lb vserver [ ]
  • show lb vserver
Example
> add lb vserver vserver-SSL-1 SSL 10.102.29.50 443
Done
> show lb vserver vserver-SSL-1
vserver-SSL-1 (10.102.29.50:443) – SSL Type: ADDRESS
State: DOWN[Certkey not bound] Last state change was at Tue Jun 16 06:33:08 2009 (+176 ms)
Time since last state change: 0 days, 00:03:44.120
Effective State: DOWN Client Idle Timeout: 180 sec
Down state flush: ENABLED
Disable Primary Vserver On Down : DISABLED
No. of Bound Services : 0 (Total) 0 (Active)
Configured Method: LEASTCONNECTION Mode: IP
Persistence: NONE
Vserver IP and Port insertion: OFF
Push: DISABLED Push VServer: Push Multi Clients: NO Push Label Rule: Done
Caution: To ensure secure connections, you must bind a valid SSL certificate to the SSL-based vserver before you enable it.

securing load balanced traffic by using ssl

  • enable feature SSL
  • show ns feature
Example 
> enable feature ssl
Done
> show ns feature
Feature Acronym Status
——- ——- ——
1) Web Logging WL ON
2) SurgeProtection SP OFF
3) Load Balancing LB ON . . .
9) SSL Offloading SSL ON
10) Global Server Load Balancing GSLB ON . .
Done >

binding a compression policy to a vserver

To bind a compression policy to a vserver by using the NetScaler command line

At the NetScaler command prompt, type the following commands to bind a compression policy to an LB vserver and verify the configuration:
  • bind lb vserver -policyName
  • show lb vserver
Example
                            > bind lb vserver lbvip -policyName ns_cmp_msapp
                            Done
                            > show lb vserver lbvip
                            lbvip (8.7.6.6:80) - HTTP       Type: ADDRESS
                            State: UP
                            Last state change was at Thu May 28 05:37:21 2009 (+685 ms)
                            Time since last state change: 19 days, 04:26:50.470
                            Effective State: UP
                            Client Idle Timeout: 180 sec
                            Down state flush: ENABLED
                            Disable Primary Vserver On Down : DISABLED
                            Port Rewrite : DISABLED
                            No. of Bound Services :  1 (Total)       1 (Active)
                            Configured Method: LEASTCONNECTION
                            Current Method: Round Robin, Reason: Bound service's state changed to UP
                            Mode: IP
                            Persistence: NONE
                            Vserver IP and Port insertion: OFF
                            Push: DISABLED  Push VServer:
                            Push Multi Clients: NO
                            Push Label Rule:

                            Bound Service Groups:
                            1)      Group Name: Service-Group-1

                            1) Service-Group-1 (10.102.29.252: 80) - HTTP State: UP Weight:                                              1

                            1)      Policy : ns_cmp_msapp Priority:0
                            Done

configuring services to compress data

  • set service -CMP YES
  • show service
Example
> show service SVC_HTTP1
SVC_HTTP1 (10.102.29.18:80) – HTTP
State: UP
Last state change was at Tue Jun 16 06:19:14 2009 (+737 ms)
Time since last state change: 0 days, 03:03:37.200
Server Name: 10.102.29.18
Server ID : 0   Monitor Threshold : 0
Max Conn: 0     Max Req: 0      Max Bandwidth: 0 kbits
Use Source IP: NO
Client Keepalive(CKA): NO
Access Down Service: NO
TCP Buffering(TCPB): NO
HTTP Compression(CMP): YES
Idle timeout: Client: 180 sec   Server: 360 sec
Client IP: DISABLED
Cacheable: NO
SC: OFF
SP: OFF
Down state flush: ENABLED
1)      Monitor Name: tcp-default
State: DOWN     Weight: 1
Probes: 1095    Failed [Total: 1095 Current: 1095]
Last response: Failure – TCP syn sent, reset received.
Response Time: N/A
Done

enabling compression

By default, compression is not enabled. You must enable the compression feature to allow compression of HTTP responses that are sent to the client.
  • enable ns feature CMP
  • show ns feature
Example
> enable ns feature CMP
Done
> show ns feature
Feature                        Acronym              Status
——-                        ——-              ——
1)     Web Logging                    WL                   ON
2)     Surge Protection               SP                   OFF
.
7)     Compression Control            CMP                  ON
8)     Priority Queuing               PQ                   OFF
.
Done
Most of them may not aware of this. Here is the steps...
  • set lb vserver [-backupVserver ]
  • show lb vserver

Example

> set lb vserver vserver-LB-1 -backupVserver vserver-LB-2

Done

> show lb vserver vserver-LB-1

vserver-LB-1 (10.102.29.60:80) – HTTP   Type: ADDRESS

State: DOWN

Last state change was at Wed Jun 17 08:56:34 2009 (+661 ms)

.

.

.

Backup: vserver-LB-2

.

.

.

Done


configuring url redirection

You can configure URL redirection to provide notifications of vserver malfunctions, and you can configure backup vservers to take over if a primary vserver becomes unavailable.
  • set lb vserver -redirectURL
  • show lb vserver
Example
> set lb vserver vserver-LB-1 -redirectURL http://www.newdomain.com/mysite/maint                                             enance
Done
> show lb vserver vserver-LB-1
vserver-LB-1 (10.102.29.60:80) – HTTP   Type: ADDRESS
State: DOWN
Last state change was at Wed Jun 17 08:56:34 2009 (+666 ms)
.
.
.
Redirect URL: http://www.newdomain.com/mysite/maintenance

No comments:

Post a Comment