Serial console on hardware appliances

[HugoVanDerKooij]

As a (network) engineer I am used to having serial console access to physical devices.

I noticed this is not enables by default on RSA Netwitness appliances. Notr is it anywhere documented here on RSA Link.

Preferably I want a supported and upgrade proof solution. Anyone been working on that?

[HugoVanDerKooij]

It seems a description like How to Enable Serial Console Output in CentOS  might help us out here.

I need to test it on our test unit.

[Anonymous]

We normally use iDRAC for that. 
You can configure an additional Ethernet connection, which gives you the ability to remotely manage the appliance and also have console access.

Please have a look at the Hardware Setup Guide. 

[HugoVanDerKooij]

Before this action I had:

[root@nwhybrid ~]# ps ax|grep tty
5896 tty1 Ss+ 0:00 /sbin/agetty --noclear tty1 linux
91702 pts/0 S+ 0:00 grep --color=auto tty

I changed the line to:

GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=netwitness_vg00/root rd.lvm.lv=netwitness_vg00/swap biosdevname=0 net.ifnames=0 rhgb quiet rd.shell=0 console=ttyS0"

[root@nwhybrid ~]# stty -F /dev/ttyS0 speed 9600
9600
[root@nwhybrid ~]# grub2-mkconfig -o /boot/grub2/grub.cfg
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-3.10.0-957.27.2.el7.x86_64
Found initrd image: /boot/initramfs-3.10.0-957.27.2.el7.x86_64.img
Found linux image: /boot/vmlinuz-3.10.0-862.14.4.el7.x86_64
Found initrd image: /boot/initramfs-3.10.0-862.14.4.el7.x86_64.img
done
[root@nwhybrid ~]# systemctl start getty@ttyS0
[root@nwhybrid ~]# systemctl enable getty@ttyS0
Created symlink from /etc/systemd/system/getty.target.wants/getty@ttyS0.service to /usr/lib/systemd/system/getty@.service.
[root@nwhybrid ~]# ps ax|grep tty
5896 tty1 Ss+ 0:00 /sbin/agetty --noclear tty1 linux
93263 ttyS0 Ss+ 0:00 /sbin/agetty --noclear ttyS0 vt220
93298 pts/0 S+ 0:00 grep --color=auto tty

So far it work in having serial console output from the boot process.

But I am not getting a login prompt.

[HugoVanDerKooij]

Today was a great example why iDraq is not that useful. The customer did a shutdown on both switch ports because someone said they saw MAC flapping and it must the RSA appliance. So then having a seiall console becomes a lifesaver. 

So I want it very much to become a standard feature as it might be the only way to access the appliance in the datacenter.

[JohnSnider]

Back in the past, we had the serial ports active on our devices, though we found an issue where if nothing was connected to the serial port, during a crash of the system, it would hang and never reboot (it appears it was trying to dump the crash to the serial port and that was causing the hang) and it required someone to manually power cycle the system to recover from the hang.  So we (PS) made it a habit to disable that function for customers that had remote systems and were not using idrac.  

With the newer releases, it was decided to NOT configure the port for access by default, and give customers the option to enable if they were using a serial console server (or at their own risk)

I have a large customer that uses serial port consoles as a backup to the iDRAC and we use this script to enable the serial port

# update grub2 for console access via serial port
if [[ ! $(grep '\ console\=ttyS0\,115200n8\ console\=tty0' /etc/default/grub) ]];then
echo "Configuring Grub2 Serial Console Settings"
sed -i 's/\brd.shell=0/& console=ttyS0,115200n8 console=tty0/' /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg" | grep "Generating grub configuration file ..."
echo "NOTE: System must be rebooted before Serial Port access will work."
else
echo "Serial port access already configured on host"
fi

[RichardB]

In addition to changing the GRUB_CMDLINE_LINUX add these lines to /etc/default/grub to be able to interact with grub before boot:

GRUB_TERMINAL="serial"

GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"