vManage have root ?

[ADC Lane]

Hi Team, 

I am wonder that vmanage have root account. Some times, I use root account and ssh to vmanage, it still request password of the account. So the root account is still alive for vManage or be disabled ?

Thanks in advance !

[svemulap@cisco.com]

hi ADC Lane -

Which version that you are trying with ?

[ADC Lane]

Hi svemulap@cisco.com i am using version 20.6.3.1 .Thank you in advance !

[svemulap@cisco.com · Accepted solution]

Thx., ADC Lane.

To get to the root level access (via vsh), you do need TAC help as this is very intrusive and could cause other side effects.
There are instances, where it could be needed.
In general, it is highly discouraged and not recommended.
admin level access provides - admin level only. There is no 'root' level.

HTH

[ADC Lane]

Hi svemulap@cisco.com , it mean there are no way to access to vmanage by Root account by ssh, https, scp ... right ? root vshell need user account and need do by TAC in case need. 

[maxnpj]

Have you actually authenticated to vManage using the "root" account? I don't think you have access to that account; you have access to "admin" but not root...but maybe I'm misunderstanding the question. 

[ADC Lane]

Hi @maxnpj , in vmanage, I can use some commands same in linux, so I think root account is alway exist in linux, I wonder vmanage have root account and then test SSH to it, of course, I dont know password and can not access to vManage.

So I am wonder whether root account is still alive or just only admin account.

[maxnpj]

You are correct, there is a root account, but I'm pretty sure you have no access to it. You do have "admin" access but those rights/privileges are lower than root. From the vshell as "admin" you can run Linux commands but, for example, there are many directories you cannot get to, and there are certain Linux commands you can't run as "admin". I've been on TAC calls where they've had to login as root and they have to use some zillion-bit token to get authenticated as root. 

[ADC Lane]

Hi @maxnpj 

Casual, I found one topics in internet, they have published  vmanage pentest results,

https://www.synacktiv.com/en/publications/pentesting-cisco-sd-wan-part-1-attacking-vmanage.html 

It includes 1 way to get root shell, i wonder  whether do later firmwares fix this error ? And if root privilege is got, what happen :)) ?

[Kanan Huseynli · Accepted solution]

Hi,

TAC has read-only and read-write based users. Root can only be accessed by hacking. With root you most probably can do all system/ file access.

[ADC Lane]

Hi @Kanan Huseynli , thank you for your reply

I have question, if root account is spam and clock, vManage operation is affected?

[Kanan Huseynli]

Hi,

don't think so. And "account lock" means, you can't login with this account. There is no process that requires root login (I haven't seen anyone).

by the way, normally after some time account should be unlocked.

[svemulap@cisco.com]

Exactly. It is correct.

[ADC Lane]

Hi @Kanan Huseynli  , Thank you so much !

[ADC Lane]

Thank you so much svemulap@cisco.com