root_enable password / Cisco Prime

[ihabhamada]

We have Cisco Prime Infrastructure ver 2.2.7 as a VM. we activate the FIPS and sat a root_enable password. Unfortunately root_enable password set by someone and he has forgotten it.

I would like to reset my root_enable password.

how / where can I do this?

Thanks

Ihab

[Mark Malone]

Hi

heres the link to recover the admin password

http://www.cisco.com/c/en/us/support/docs/cloud-systems-management/prime-infrastructure/115609-ppr.html

and this

http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-2/administrator/guide/PIAdminBook/maint_sys_health.html#pgfId-1091117

[ihabhamada]

Hi,

thanks for the Answer.

but I would like to reset the "root_enable" PW in the non-FIPS mode. not the admin PW.

________________

XXprimeXX/primex# root
root          root_disable  root_enable
XXprimeXX/primex# root
Enter root password :
% Error : invalid root password
XXprimeXX/primex# root_enable
% Error : root password already set
XXprimeXX/primex#

_______________

[Mark Malone]

Ah ok my admin and root are the same :)

try this may work

http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-1/administrator/guide/PIAdminBook/maint_sys_health.html#pgfId-1082716

[ihabhamada]

I already tried it.

to do that I have to enter to the root mode :-)

and I don`t have the PW therefor.

without to enter the the "root-mode" I change the web root PW with this command.

[Mark Malone]

Ha I should have noticed that bit early still

try this

root_disable

root_enable

and then you should be able to change the password

for GUI

ncs webroot disable

then

ncs webroot enable

and then you should be able to change the GUI root password

[ihabhamada]

I need the current root PW für the "root_disable" command.

__________

primeXX/PrimeX# root_disable
Enter root password :

_____

[renjithg]

In PI 2.2, there is no direct command to reset root shell password since we make sure customer is well aware of this password.

If you are well done with  root shell operation, disable the root password immediately in order to avoid attack.

Please find the following procedure to recover the root shell password:

1- Boot off of a CentOS/RedHat 5 or 6 install CD or DVD.

Use any of the following ISO images:

CentOS-5.10-x86_64-bin-DVD-1of2.iso
CentOS-5.11-x86_64-bin-DVD-1of2.iso
CentOS-6.6-x86_64-bin-DVD1.iso

2- Once booted, type "linux rescue" on prompt and hit ENTER key

3- Chose default options for language/keyboard and don't choose network option

4- You will see a message as below:
The rescue environment will now attempt to find your Linux installation and mount it under the directory /mnt/sysimage. You can then make any changes required to your system. If you want to proceed with this step choose 'Continue'. You can also choose to mount your file systems read-only instead of read-write by choosing 'Read-only'. If for some reason this process fails you can choose 'Skip' and this step will be skipped and you will go directly to a command shell.

Choose "Continue" in this screen

5- Once an existing installation is found, it will be mounted to "/mnt/sysimage" location and you will be dropped to command prompt.

6- Change root to the PI install location by using following command:

# chroot /mnt/sysimage

7- Move /storeddata/rootpatchpw

#mv /storeddata/rootpatchpw /root/

8- Now type "exit" and hit ENTER key

9- Type "reboot" and boot into PI

Please rate my asnwer :)

[Mady Gueye]

Hi all,
I have error to my CPI 3.1
In my console ESXI:
/dev/mapper/smosvg-optvol 2376/256000 files 244058/1024000 blocks (check after next mount) [failed]

An error occured during the file system check

Need your help

[Evan Wheatley]

On Prime 3.1.6 I found the path for rootpatchpw was actually /storedconfig/

In short all steps above works - however for step 7 use the following:

#mv /storedconfig/rootpatchpw /root/

Thanks for all the other steps @renjithg!

[Andrii Oliinyk]

Hi Evan

after following your advice i still have CLI login prompt & fail to login with root as user. any other users are disallowed to CLI because root is primary admin account in our CPI.

[Andrii Oliinyk]

disregard. resolved with root password change from rescue CD

[govasrin]

Hi Ihab ,

With regards to your main question,  I see you mentioned that your/team installed PI with FIPS enabled and then trying to but unable to reset root_enable password.

Hence I need to make you aware of the fact that FIPS mode is introduced to meet certain security standards and as part of the same, access to root shell is disabled in FIPS mode.  Be informed that the option to enable FIPS appears during PI installation phase itself.  If you are certain that PI has been installed in FIPS mode, then it's obvious that it will restrict access to root shell (CLI) of the PI and related other features as mentioned below:

Please find the list of features:

If you enable FIPS mode, TFTP and FTP are disabled by default. SFTP is used for upload and download operations.

• The Plug and Play features are not available if you enable FIPS mode.
• If you enable FIPS mode, you cannot enable root, and access to the root-mode CLI is restricted.

However certain features like  FTP and TFTP can be enabled going to "Administration > System Settings > Server Settings".

Since the access to root shell is completely (disabled) permanently, there's no question of enabling root access or resetting its password.

I hope this answers your query appropriately, however if you still need the root access (resetting the root password), you can follow the steps shared by Renjith in this thread above.

Thank you.

Regards,

Govardhan

Rating encourages contributors !!