Password Reset

[Jay Richardson]

A server has Insight Manager management agents installed but cannot be access because the person who set it up did not record the password. Is there a way to recover, reset or remove the password? It is for the generic login of "administrator".

Thanks!

"Eagles never got off the ground."

[Larry Shaw]

You can use the Remote Deployment Utility to reinstall one of the three agents which requires the password and that will reset the password to one of your choice.

In the RDU, this would be one of the three agents that are shown as "configurable" or that are reported as requiring configuration. These are the Foundation Agents, The Survey Utility or the Version Control Agents.

[Scott Shaffer]

Larry is correct - but there is another way too. You can copy the files containing the authentication data from a system that is setup correctly to all the ones that aren't. This might save time as copying the files around (and then rebooting the servers) might be faster for multiple servers than reinstalling the agents through RDU would be.

You can find the files to copy listed in the Agents Users Guide (which is on the Management CD.)

[Oliver Klahr]

I would also just copy the password file onto all the other servers, but you don??t have to reboot them afterwards. You just have to restart the Compaq Web Agent service on the affected servers.
Oliver

[Scott Shaffer]

Olivar - you can do a stop/start of the services instead of a reboot, but the problem is finding all the applications that use the web server. You have to do more than just the Web Agents - you have get the Survey utility, ACU XE, the web-based UPS software, and more. A reboot is usually what I say to avoid this problem of having to know what services to deal with.

Scott

[James A McEuin · Accepted solution]

The Web Management Agents use several configuration files. We have tightened our security using these guidlines. If you are below version 5.x, you should first upgrade to the latest version (at least 6.x) and then replace all the files after making changes as listed below. You can "model" the files on a test server and deploy to everything else. Basically, stop the service, replace the files, start the service. No reboot.

1. CPQHMMD.ACL (c:\ compaq\WBEM\) ??? Stores password information. Should not be edited manually. Use GUI to change passwords and copy the file.

2. CPQHMMD.INI (c:\ compaq\WBEM\homepage\) ??? Controls Remote Anonymous Access. The following lines should be included for protecting the system.
[HMMDConfiguration]
DiscoveryMaster=false
AnonymousAccess=false

Use the GUI or manually edit the file.

3. CPQHMMdx.ini (c:\ compaq\WBEM\homepage\) ??? Controls Local Console Access and Insight Manager 7 communication controls. The following lines should be included.
[HMMDConfiguration]
LocalAccessEnabled=false
LocalAccessType=Anonymous
TrustMode=TrustByCert

Use the GUI or manually edit the file.

Note: LocalAccessType should only exist if local system is running Insight Manager 7. Should not be included otherwise)

4. %InsightManagerServername%.pem (c:\COMPAQ\WBEM\certs\) ???

This file helps when certain controls can't be set by other security methods.

You can write batch scripts to deploy these. We have a perl wrap-around that works wonders for every batch file we create. Basically, it runs the batch files over and over for a preset list of server names that it inserts into the batch file. But, anyway, the above information contains the details about what files to change out. Just make the files you want on a test server, stop the service, copy the files over, and restart. Voila' you are good to go.

[David Bartley]

I have tried the method of reseting passwords described on this thread. I am now getting the following error

Compaq Web Agent No SNMP community String error.

Can anyone shed any light on this error. I have searched this site but can find no references.

Thanks.

[Rob Buxton]

You'll need to look at the Properties of the SNMP Service.
You need at least a Community name that is also on the IM Server (could be public) and this should be Read Only.
Ideally add a second Community name and give that Read/Write Access, again the IM Server should also have this Community name in the SNMP Service.