How to recover an RSA NetWitness Suite 11.0 system if bootstrap fails because of unsupported characters in the password

Issue

Bootstrap is failing on an RSA NetWitness Suite 11.0 system due to unsupported characters in the password.

Beginning the deployment password with a hyphen ( - ) or double hyphen ( -- ) will cause bootstrap to fail.

Resolution

Follow the steps below to resolve the issue.

1. Remove the security-client-amqp.yml file.
   rm /etc/netwitness/security-client/security-client-amqp.yml
    
2. Remove the mongo.registered file.
   rm /etc/netwitness/platform/mongo/mongo.registered
    
3. Delete the deploy_admin account in RabbitMQ.
   rabbitmqctl delete_user deploy_admin
    
4. Delete the deploy_admin account in MongoDB.
   mongo
   use admin
   db.system.users.remove({"user":"deploy_admin"})
    
5. Re-run the Text-based UI. (TUI)
   nwsetup-tui

Product Details

RSA Product Set: NetWitness Logs & Packets
RSA Product/Service Type: Admin Server
RSA Version/Condition: 11.0
Platform: CentOS
O/S Version: EL7

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue