ISE- boot menu asking for password

[teamdv6199]

I am trying to boot to a usb but ise keeps asking me for a password. I dont know it. I accessed CIMC but I dont see any settings for boot menu passwords. Does anyone know how to clear it?

[ahollifield]

What is the hardware appliance?  What model?  

[teamdv6199]

ise 3595 vs 2.7. Is there a jumper i can reseT?

[teamdv6199]

Attached is a picture 

[ahollifield]

Yeah looks like someone has configured a boot password.  Maybe the Cisco UCS HHU utilities have a reset option in the bootable media?

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/eos-eol-notice-c51-742122.html

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html

[teamdv6199]

Sorry those links don't really help, do you know how to access the HHU?

[andrewswanson]

Can you SSH to your server's CIMC?

When I connect to an SNS-3655-K9 appliance CIMC IP address via SSH, I can enter the following command "scope bios".

This give access to various commands that could be helpful (see below) - maybe the "clear-cmos" would clear the password.

hth

Andy

activate Activate alternate bios
bios-setup-default Set default values for BIOS setup parameters
cancel-activate Cancel Pending bios Activation requests
cancel-update Cancel the BIOS update (only permitted during the do
clear-cmos Clear BIOS CMOS
commit Batch commit changes
connect Connect to other console
create-boot-device Create bootable devices that BIOS will pick to boot
discard Discard all changes
enable-all-boot-device Enable all created bootable devices
enter-bios-setup Enable enter BIOS Setup on next reboot
exit Exit from command interpreter
re-apply Re-apply boot order to BIOS (needed when "Last Confi
rearrange-boot-device Rearrange the selected boot devices in single execut
remove-boot-device Remove created bootable device
restore-mfg-defaults Reset BIOS setup parameters to manufacturing default
scope Changes the current mode
set Set property values
show Show system information
top Go to the top mode
update Update alternate bios

[andrewswanson]

Looks like you can change the Power On password from CIMC without clearing CMOS on my appliance (output of show security on my appliance shows that the password is not set):

scope bios
show security
   Power ON Password: Disabled
   SHA-1 PCR Bank: Enabled
   SHA256 PCR Bank: Enabled
   Trusted Platform Module State: Disabled
   Intel Trusted Execution Technol: Disabled
scope security
set PowerOnPassword <VALUE>

[teamdv6199]

There is no poweonpassword option for me just these:

activate Activate alternate bios
bios-setup-default Set default values for BIOS setup parameters
cancel-activate Cancel Pending bios Activation requests
cancel-update Cancel the BIOS update (only permitted during the do
clear-cmos Clear BIOS CMOS
commit Batch commit changes
connect Connect to other console
create-boot-device Create bootable devices that BIOS will pick to boot
discard Discard all changes
enable-all-boot-device Enable all created bootable devices
enter-bios-setup Enable enter BIOS Setup on next reboot
exit Exit from command interpreter
re-apply Re-apply boot order to BIOS (needed when "Last Confi
rearrange-boot-device Rearrange the selected boot devices in single execut
remove-boot-device Remove created bootable device
restore-mfg-defaults Reset BIOS setup parameters to manufacturing default
scope Changes the current mode
set Set property values
show Show system information
top Go to the top mode
update Update alternate bios

[andrewswanson]

See link below for CIMC cli commands - you will have to use "commit" to save any changes.

Andy

https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/sw/cli/command/reference/b_Cisco_UCS_C-Series_Servers_Integrated_Management_Controller_CLI_Command_Reference/Cisco_UCS_C-Series_Servers_Integrated_Management_Controller_CLI_Command_Referen...

[andrewswanson]

From that output it looks like you are still in the bios scope. Type "scope security" - you should have the set PowerOnPassword option then.

hth

Andy

[teamdv6199 · Accepted solution]

create-boot-device bootmenu this is the way i booted into it. 

[teamdv6199]

There is no scope security in any mode. At least for me in 2.7