Overview

Your Cyber Security or Information Security Incidents Team is requesting to isolate a server and deactivate the network interfaces for further investigation due to numerous unusual logins seen in the SMSC side.

Solution

If Node is Reachable:

Stop Devices on the Node

1. SSH login as textpass to the node that needs to be isolated/deactivated.
2. Stop all processes using the tp_stop command.
3. Check processes status and ensure all processes are Not active using the tp_status command.

Disable Processes in Host Config File

1. Backup the host configuration file using the below 2 commands:
   cd /usr/TextPass/etc
cp <hostname>_config.txt <hostname>_config_pre_isolate.txt
   
2. Open the <hostname>_config.txt file using the vi editor and set the following to false:

   runtpfclientprocess="false"
   runtextpassprocess="false"
   runtexthubprocess="false"
   runtextamsprocess="false"
   runtextfafprocess="false"
   runtextbatprocess="false"
   runqclidprocess="false"
   runtextpbcprocess="false"
   runtextlgpprocess="false"

3. Save the file using :wq!.

Isolate Devices in the GUI

1. Login into the MGR GUI with an Admin user.
2. Navigate to Settings > Network Layout > Devices.
3. Note the devices on the node to be isolated.
4. Right click and deactivate the devices on the node.
5. Click on all devices one by one.
6. Uncheck the box for Allow Connection.
7. Save the device.

Repeat for each device for the node.

Disable Ethernet Interfaces

1. Login to the node as root.
2. Check all the configured interfaces using the ifconfig -a command.
3. Based on the output of the previous command, disable the interfaces using the ifdown <interface_name> command.

By visiting onsite, long press the power button to power down the affected node.

 

If Node is not Reachable:

If Node can be Reached via ilO

1. Login via the ilO interface
2. Select Remote Console
3. Once the remote console is open, follow steps defined in the above If Node is Reachable section.

If Node cannot be Reached via ilO

If the node is not reachable, even via the ilO interface, then procedure on MGR node must
be carried out as per the above Isolate Devices in the GUI section.

 

By visiting onsite, long press the power button to power down the affected node.