Recover TufinOS Administrative Access

In TufinOS administration privileges are handled through the tufin-admin user. The root user is required to replace or recover the password of the tufin-admin aacount.

These procedures explain how to reset the root user password and replace the tufin-admin user. Resetting the root user password, requires entering rd.break mode.

These procedures are also relevant for non-TufinOS Linux systems.

Prerequisites

Console access

Reset the Root User Password

Reboot the operating system.
When the grub menu appears, make sure the first line (the number of lines depends on the operating system version) is selected and press e to edit.
Add the rd.break boot parameter.

This parameter interrupts the boot process.

From the grub options, find the line that starts with linux and add rd.break to the end of the line.

Press Ctrl+X to reboot.

The root file system is mounted in read only mode to /sysroot and must be remounted with read/write (rw) permissions.
Enter mount -o remount,rw /sysroot.

After remounting, you are going to need to switch to chroot jail so that that /sysroot is used as the root of the file system. This is required so that any further commands you run will be in regards to /sysroot.
Enter chroot /sysroot.
To reset the password of the root user, enter passwd.
Enter the new password and then retype it.

You have updated the password of the root user.
To exit the chroot jail environment and reboot the system, enter Exit twice.

Once the system reboots, you will be able to access the root user account with the password you created.

Disable tufin-admin User

Remove the login shell.
```
chsh -s /bin/nologin tufin-admin
```
To block authentication, lock the tufin-admin user.
```
passwd -l tufin-admin
```
Disable the tufin-admin user by setting its account expiration.
```
chage -E0 tufin-admin
```

Create a new admin user.

mkdir -p /opt/os_users/home/

chmod 0755 /opt/os_users /opt/os_users/home

useradd -m -d /opt/os_users/home/<username> -k /etc/skel/ <username>

ln -s /opt/os_users/home/<username> /home/<username>

Where <username> is the name of the new admin user.