Article Number: 000026589

Resetting Root Password on RSA NetWitness® Appliances Legacy Article ID: a64266

Resetting Root Password on RSA NetWitness® Appliances

If the root password is lost on an RSA NetWitness® appliance it is possible to reset the password at the
console or via the iDRAC.

Overview
Please follow these instructions to reset the root password on CentOS 5.x or 6.x appliances. These steps may
work on older Fedora Core appliances as well but this has not been tested at this time.

This solution assumes that the appliance is not operational and is not capturing or aggregating data but that the
appliance will boot to the operating system and is otherwise fuctional.

Resources Required
In order to complete the steps listed in this document you will need the following tools:

 A communications tool such as putty, or HyperTerm, or other ssh tool.

 Access to the console or iDRAC of the appliance.
 A web browser if connecting to the iDRAC on the appliance.
 Access to knowledge base articles on RSA Link at https://community.rsa.com/netwitness.
 Access to web sites such as http://wiki.centos.org/TipsAndTricks/ResetRootPassword.

Contacting RSA NetWitness Support

For assistance, open a customer support case via RSA Link. (See https://community.rsa.com/docs/DOC-1294)

Documentation Conventions
Commands that are to be entered at a command or shell prompt are entered in the Courier New font. For
example, when asked to run one or more commands at a prompt, the commands will be listed like:

mount
cd /root

Documentation Updates
RSA NetWitness strives to produce accurate, useful, and comprehensible technical documentation. If you have a
question, suggestion or comment about a document, please contact us. Please refer to the document title,
Primus article number, document revision and date when commenting. We appreciate your feedback.

1 | Page Revision 0.60

© 2018 by Dell Technologies, all rights reserved. 5 November 2018
Resetting the Root Password
Follow these detailed steps to reset the root password on your RSA appliance. Note that this process will
require a reboot of the appliance.

Connect to the Appliance

1. Connect to the appliance at the console or via the iDRAC.
2. Power cycle the appliance and wait for the Grub menu to display. Note that the system will
automatically proceed with the boot process if not interrupted by pressing any key within 5 seconds
after the Grub menu is displayed.

3. At the Grub menu, enter “p” to enter a password to unlock the Grub menu for resetting the password.
The default password for the Grub menu is “netwitness”.
4. Enter ‘a’ to modify the kernel arguments before booting the system.

2 | Page Revision 0.60

© 2018 by Dell Technologies, all rights reserved. 5 November 2018
5. At the “grub append>” prompt enter the numeral “1” to boot into single-user mode and then press
“Enter”.

6. The appliance will boot into single user mode and echo this on the console. Press the “Enter” key to
display a prompt if necessary.

3 | Page Revision 0.60

© 2018 by Dell Technologies, all rights reserved. 5 November 2018
 7. Use the “passwd” command to enter the new root password. Note that you will be warned if you
choose a bad or weak password such as a word based on dictionary word but you will be able to enter a
bad or weak password unless you have altered the default password options.

The root password has now been reset. Reboot the password, allow the appliance to boot normally and verify
the appliance is licensed, all services are running, and the appliance is capturing or aggregating as expected.

4 | Page Revision 0.60

© 2018 by Dell Technologies, all rights reserved. 5 November 2018