How to Recover Admin Password and Remove Restrictions on Security Group Outbound Rules?

[wbadyx]

1、If my admin user forgets the password, how can I recover the password or recreate the user?

2、I need to modify the code so that the generated security group's outbound rules have no restrictions. How can I do that?

[mcrozes]

1、If my admin user forgets the password, how can I recover the password or recreate the user?

If you already have another user with admin permission on SOCA, you can reset someone's else password via https://awslabs.github.io/scale-out-computing-on-aws/web-interface/manage-ldap-users/#reset-password-for-a-given-user

If you do not have any other admin user, you can update the password for your user via CLI. Login to the Scheduler host either via SSH or SSM, then sudo as root user.

Run the following commands:

source /etc/environment
curl --silent -k -H "X-SOCA-TOKEN: $(cat /apps/soca/<SOCA_ENV>/cluster_web_ui/keys/admin_api_key.txt)" \
 --data-urlencode "user=<USERNAME>" \
 --data-urlencode "password=<PASSWORD>" \
 -X POST https://127.0.0.1:8443/api/user/reset_password 

See the example below, assuming my SOCA cluster name is soca-debug, my username is socaadmin and the new password Hello123

 [root@ip-110-0-99-240 ~]# curl --silent -k -H "X-SOCA-TOKEN: $(cat /apps/soca/soca-debug/cluster_web_ui/keys/admin_api_key.txt)" \
>  --data-urlencode "user=socaadmin" \
>  --data-urlencode "password=Hello123" \
>  -X POST https://127.0.0.1:8443/api/user/reset_password
{"success": true, "message": "Password updated correctly."}

Below is also an example if you want to create a new user from CLI

curl --silent -k -H "X-SOCA-TOKEN: $(cat /apps/soca/<YOUR_SOCA_NAME>/cluster_web_ui/keys/admin_api_key.txt)" \
 --data-urlencode "user=<USERNAME>" \
 --data-urlencode "password=<PASSWORD>" \
 --data-urlencode "sudoers=1" \ # change to 0 for non-admin
 --data-urlencode "email=admin@soca" \
 -X POST https://127.0.0.1:8443/api/ldap/user

2、I need to modify the code so that the generated security group's outbound rules have no restrictions. How can I do that?

Security Groups configuration can be found https://github.com/awslabs/scale-out-computing-on-aws/blob/main/installer/resources/src/cdk_construct.py#L338.

If you are focusing on outbound, refer to https://github.com/awslabs/scale-out-computing-on-aws/blob/main/installer/resources/src/cdk_construct.py#L499. However, egress rules for both Scheduler & Compute Nodes already don't have any restrictions.

[wbadyx]

That's very helpful, thank you.