topic Re: Looking for Cisco ISE 2.4 Rootpatch file in Network Access Control

Looking for Cisco ISE 2.4 Rootpatch file

Beacon Bits — Wed, 05 Dec 2018 18:05:10 GMT

Hello everyone,

I'm looking for a file to get a root access on Cisco ISE.

It requires this patch but I'm unable to find anywhere (root-patch file for Cisco ISE 2.4)

The file name is :

ssh-rootpatch-hrpsshnodisk.tar.gz

Could anyone please provide the link, please?

Regards,

Re: Looking for Cisco ISE 2.4 Rootpatch file

Jason Kunst — Wed, 05 Dec 2018 18:08:31 GMT

The root patch is for tac and engineering use only

Please work through the tac

Re: Looking for Cisco ISE 2.4 Rootpatch file

Beacon Bits — Wed, 05 Dec 2018 18:15:29 GMT

Hi Jason,

Thanks, So I should stop looking for it.

I did read this on Cisco docs and other blogs as well.

Regards,

Re: Looking for Cisco ISE 2.4 Rootpatch file

Damien Miller — Wed, 05 Dec 2018 18:20:31 GMT

The root key that accompanies the root patch also expires. So even if you were to find both online somewhere that someone shared, it likely wouldn't work.

Re: Looking for Cisco ISE 2.4 Rootpatch file

Mark Elsen — Wed, 05 Dec 2018 18:50:26 GMT

- And it shouldn't be , if you are using open-source (Linux) as the underlying carrier-engine for ISE , then let users benefit from this too (open-source mindfulness) , when there are special problems,

Re: Looking for Cisco ISE 2.4 Rootpatch file

Jason Kunst — Wed, 05 Dec 2018 18:54:31 GMT

Please provide feedback using the ISE tool in the upper right.

Re: Looking for Cisco ISE 2.4 Rootpatch file

Mark Elsen — Wed, 05 Dec 2018 19:02:53 GMT

- Cute, that seems more like a 1000-year action plan,,,,,! 🙂

Re: Looking for Cisco ISE 2.4 Rootpatch file

Jason Kunst — Wed, 05 Dec 2018 19:05:31 GMT

We don’t get in these discussions on technical help community

You can reach out with your sales team if this is a NEEDED feature.

Re: Looking for Cisco ISE 2.4 Rootpatch file

Mark Elsen — Wed, 05 Dec 2018 19:49:07 GMT

- It >is< a technical issue; in the sense that an ISE customer shouldn't depend on a CISCO TAC case with long latency , when just needing to clear a ./tmp or /var/tmp on ISE which is usually production critical, But I don't want to end up in a war-style discussion either. Thanks for your advises.

Re: Looking for Cisco ISE 2.4 Rootpatch file

Jason Kunst — Wed, 05 Dec 2018 20:07:31 GMT

I understand I will bring it up but more people bugging our PMs directly will get the WD40 ☺

Re: Looking for Cisco ISE 2.4 Rootpatch file

Arne Bier — Thu, 06 Dec 2018 19:53:37 GMT

The guys on the Community forum know that I have ranted about this before but I am glad I am not the only one. And as Jason points out all the time, the PM's are not on these forums (which I think is a mistake and a shame). Other Cisco products allow customers to get root access and it's not a technical advantage to block users from root access. It's a CYA strategy and probably resulted from one nasty incident where one customer did something stupid and ruined it for all of us forever more.

The other fact is that if you get hold of this root patch, you can play around with it all you want - the cert lasts quite long actually. So that in itself is a weak deterrent.

I have submitted numerous enhancements via the feedback form but I don't know where it ends up. It would be nice to see how our suggestions are tracking.

Re: Looking for Cisco ISE 2.4 Rootpatch file

Surendra — Wed, 05 Dec 2018 23:21:29 GMT

Keeping the root patch discussion aside, you may want this to be checked with TAC to get to the root cause of the tmp folder filling up. This is either a bug or a VM resource allocation issue.

Coming to the Root patch discussion, we are trying to make ISE as much serviceable as possible without having the need for a root patch. Collecting a heap dump/thread dump from the CLI using “application configure ISE” in ISE 2.4 was the first step taken and trust me, we have a lot of emphasis and focus being put on serviceability and most of them are targeted for 2.6. I am not allowed to share more than this and the current stand is completely against customers having root access to the ISE and any changes needed to be done on the root will need to be done under TAC’s supervision.

Re: Looking for Cisco ISE 2.4 Rootpatch file

Jolly99er — Mon, 11 May 2020 15:10:26 GMT

If you can stop ISE VM, just mount ISE disks under another Linux VM where you have all the rights and do the cleanup. Also, having access to the ISE disks will give you the option to add an account with shell access and you can add it to sudoers. End of your stress...