Important information on user "deploy_admin" in NW 11.0

[TwinkleLath]

- The password for deploy_admin user should be same across all appliances.
- This user is used to connect rabbitmq, few mongo db tables(more or like guest user in 10.x version)

- If you change the deploy_admin user password in the NetWitness Suite User Interface (ADMIN>Security >Select deploy-admin - Reset password)
Then, follow below:
1. SSH to the NW Server host.
2. Run the (/opt/rsa/saTools/bin/set-deploy-admin-password script.
3. Use the new password when installing any new non-NW Server hosts.
4. Run (/opt/rsa/saTools/bin/set-deploy-admin-password script on all nonNW
Server hosts in your deployment.
5. Write down the password because you may need to refer to it later in the installation.

- If by mistake wrong password is used for user deploy_admin on any new node while bootstrapping,the orchestration fails. 
This state can be recovered by following:
1.First get your deploy password by logging in to your Admin server with ssh and running:
security-cli-client --get-config-prop --prop-hierarchy nw.security-client --prop-name platform.deployment.password --quiet
2.You will get your deploy password, next on your Node X that fails orchestration, open the file :
/etc/netwitness/security-client/security-client-amqp.yml
3.Change the password entry in file under deploy_admin to the deploy password retrieved from the admin server in step 1.
4.Save the file, run bootstrap again on node X, this time put the correct deploy password.
5.Once boot strap for node X is done, Install the service on it through the Admin server UI. Your node X should orchestrate correctly now.

[EmmanueleLaPort]

This Account is subject to the policies applied to all the USERS on the system.

This leads to possibility to change this password from the Admin > Security panel.

this user can be disabled for login through GUI, but it must exists and have a valid password to "orchestrate" new nodes and to perform upgrades, otherwise they will fail.

Regards Emmanuele

[Anonymous]

Hello,
Do you know how to enable the deploy_admin account through CLI?

Regards,

[MihaMesojedec]

This one should help.

echo -e 'use security-server\ndb.user.updateOne({"_id":"deploy_admin"},{$set: {"disabled": false}, $currentDate: {lastModified: true}})' | mongo admin -u deploy_admin -p 'netwitness'

[MaximSiyazov1]

I "like" how it is always done. Having introduced all this funky chef orchestration cookbooks, RSA is still failing to integrate service account management in to it requiring us to sync a deploy password across all hosts manually...

[david_waugh]

Not a great user experience at all.

4. Run (/opt/rsa/saTools/bin/set-deploy-admin-password script on all nonNW Server hosts in your deployment.

Aside from having to type lots of commands, if you have a large number of netwitness hosts, you have to do it on each box.

[Anonymous]

Thank you, Miha! That one did the trick.

[RichardB]

This is exactly what happened to us using NW 11.3.0.0

1. We updated our NW GUI password settings (complexity requirements)
2. As a result the deploy_admin GUI account expired
3. When adding a new NW node we received a message "deployment password has expired"
4. We reset the deploy_admin NW GUI account
5. Adding a new node now works with the new deploy_admin password
6. Lots of other things broke

Even Update Instructions: Appendix A. Troubleshooting Version Installations and Updates  get this wrong! It advises to reset the NW GUI password for deploy_admin and only conditionally run /opt/rsa/saTools/bin/set-deploy-admin-password

Thanks a lot for this community thread, it solved my issue while my support ticket has been unresolved for weeks.

[JoshRandall]

This is actually a perfect use of some of salt's capabilities - you can run the following command once on the admin server and let salt do all the legwork of logging in to each host and re-running the same command:

# salt "*” cmd.run "/opt/rsa/saTools/bin/set-deploy-admin-password <options>” 2>&1

[RichardB]

That is a great idea, and would perhaps work if the set-deploy-admin-password was designed for use with salt. Sadly it reads the new password from stdin and also needs the old admin password from stdin if mongodb is installed. It would be so much easier if the script would have an option to change the deploy_admin password on all other systems as well.