CMX 10.6 root/cmxadmin password reset - The configuration guide does not "work" ?

[Thomas Obbekaer Thomsen]

Well here we are - And it might be, "just me" , but have anyone tried the password recovery procedure on CMX ? (And can tell me where I fail ? )

We basically tried to follow the configuration guide on this point.

https://www.cisco.com/c/en/us/td/docs/wireless/mse/10-6/cmx_config/b_cg_cmx106/performing_administrative_tasks.html#task_5163B313D19F4F6DAB979C7E5F38143D

Recovering password procedure "failed" for us in step 5.

Step 5

Use the Down arrow key to highlight the entry that begins with the word kernel.

We just cant seem to find a entry that starts with "kernel".

So off to the next thing. "Resetting Root Password".

This seem to work.

We go through it, reset the password, write exit exit, wait, and then the login prompt shows up.

But the "root" user / password (the new one we just entered) does not work.

It just says wrong password.

Sooooo ... I feel kind of stuck here

Any suggestions ?

/Thomas

[TsvetanVladimirov81607]

There was something similar with the MSE before. There is a difference when you run Hardware or Virtual Appliance and for the virtual the kernel part was missing.
However in the same guide that you presented, there is another Root Password reset part. Check if this is going to work out for ya.
https://www.cisco.com/c/en/us/td/docs/wireless/mse/10-6/cmx_config/b_cg_cmx106/performing_administrative_tasks.html#id_90206

Cheers

[Thomas Obbekaer Thomsen]

As I mentioned, we tried the other one (and that one seems to "work" when following the instructions, in the regard that everything that is in the instructions works, but the end result does not), but when we finally try the new root password (after reboot) it fails.

So it seems that even though we go through the password change, it does not work.

We will try again today, but I cant see anywhere where we did not follow the instructions.

[TsvetanVladimirov81607]

One other thing that comes to my mind is the part from step 4 on the first option.
If the first line is not highlighted when you press "e" then there wont be any "kernel" shown in the next page.

Check this guide as well:

https://www.cisco.com/c/en/us/support/docs/wireless/connected-mobile-experiences/214403-cmx-10-5-above-cli-password-recovery.html

Good luck with the testing today.

[Thomas Obbekaer Thomsen]

That guide is actually a bit more "descriptive", so to say, and has a few different things it does.

I will try it a little later and let you know.

Our last try with the procedure in the original document gave us some output about "tokens being wrong" after we input a new password twice.

[Thomas Obbekaer Thomsen]

Just an update.

Still no luck using any of the methods.

But I found this "Community" post that actually says that there is an issue with root in 10.6

https://community.cisco.com/t5/other-wireless-mobility-subjects/upgrading-cmx-10-5-to-10-6/td-p/3825650

Asked for the BugID.

[Thomas Obbekaer Thomsen]

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq08013 - Not realted to the reset problem, but it actually states that : "On CMX 10.6 root access is only possible with help of TAC."

Ok then.

So if we want to reset the cmxadmin password, you cant login as root and do it, but ......

Then you would (still) have to go through the recovery procedure, and the specify cmxadmin as a user for resetting, like the previous link from @TsvetanVladimirov81607  showed.

Asked TAC for clarification :-)

[Thomas Obbekaer Thomsen · Accepted solution]

Yes, TAC verified.

"Root access was removed due to customer security requirements (read government requirements), so it is more in line with other Cisco products (example is Cisco ISE which also needs a root patch)."

So if you need root access, TAC can provide you with a patch, they just need the exact version of your CMX.

And if you need to reset your cmxpassword ?

Well I guess that the previous link (with the pictures of the procedure) should work, because they also reset cmxadmin in that, as far as I can see.

Will try it out :-)

/Thomas