How to put Ops Manager into Rescue Mode

Products

• Operations Manager

Issue/Introduction

If you are using an external user store (for example, SAML or LDAP) and become locked out of Operations Manager, you can enable rescue mode to troubleshoot and reconfigure your SAML or LDAP configuration. When in rescue mode, the Operations Manager will allow you to access it without authentication.

Resolution

Note:  Please ensure you have access to the decryption passphrase for your Ops Manager before performing these steps.

 

In order to enable rescue mode:

1. 1. Connect via SSH to the Operations Manager VM.
   2. Run the command, sudo touch /var/tempest/workspaces/default/rescue_mode
   3. Rescue mode will be enabled immediately.
   4. Restart Ops Manager with sudo service tempest-web restart
   5. Once you access your Operations Manager in your browser after enabling rescue mode, you'll be required to enter the decryption passphrase.

 

To disable rescue mode:

1. 1. Simply delete the rescue_mode file with sudo rm /var/tempest/workspaces/default/rescue_mode
   2. Restart Ops Manager with sudo service tempest-web restart

Please note, you will need to disable rescue mode in order to Apply changes.

Impact

This is a very risky operation! While Operations Manager is running in rescue mode, it will not require anyone to authenticate. As such, you should minimize the amount of time where rescue mode is enabled or even limit access to Operations Manager while rescue mode is enabled (perhaps with a firewall or IP restriction).

Despite the limitation above, Operations Manager does still prevent users from changing passwords (if an internal user store is being used) and the decryption key. This happens because it requires the current password/passkey before making these changes.

 

Additional Information

While rescue mode is enabled, Operations Manager will display the username in the upper right corner as "rescue mode."