Technical Tip: How to update lost root password

Root access is necessary to administrate the FortiSIEM from the CLI. In case the root password has been lost, the next steps are to boot temporarily on another system and change the password using the use of chroot command.

• Requirements:

Have the system ready to boot with the Ubuntu system, download the ISO from Download Ubuntu Desktop:

• If doing it from a hardware device, prepare a USB as described in Steps 1 and 2 from Technical Tip: How to reimage a FortiSIEM or Technical Tip: How to reimage a FortiSIEM-500G Collector.
• If it is from VM, configure the VM platform to boot from the ISO.

During this phase, the FortiSIEM application will not be available and will not process events.

• Change root password steps:

1. Change BIOS config to boot on the Ubuntu system with the Try or Install Ubuntu grub option. (Screenshot from VM).

2. Go through the initial Ubuntu setup and select Try Ubuntu and Close.
                                                     

3. Enter the terminal:
                                                           

4. Type the following commands:

sudo su

fdisk -l <-- Make sure that /dev/mapper/rl-root is listed.

mount /dev/mapper/rl-root /mnt

df -h <-- Make sure it is mounted

chroot /mnt

passwd

exit

reboot

5. Unplug the USB/ISO disk.
6. Use the newly changed root password in FortiSIEM CLI.