ASR9K password reovery

ASR9000/XR: How to reset a lost password (password recovery on IOS-XR)
版本 2
Introduction
This document shows you how to reset a lost password or when you have locked yourself out due to a problematic AAA configuration.
Core Issue
Because IOS-XR is substantially different in the way config files are managed, the standard trick of
conf-reg 0x2142 will not work for IOS-XR.
You can lock yourself out if you are configuring aaa authentication to tacacs with no local fall back, if the tacacs server is unavailable there
is no way for you to get in.
eg:
aaa authentication login default groupt tacacs
Also this procedure is good when you have forgotten the password to your super user in IOS-XR to manage your machine.
Resolution
There are 2 steps to this process.
1) Override the BASE running configuration
When you configure the problematic AAA statement sample as above.
2) Override the admin configuration that stores local usernames and passwords
When you don't remember any of the local usernames/passwords you have defined locally. Overriding the Base configuration in XR:
Step 1
In rommon set the following variable:
rommon> IOX_CONFIG_FILE=/harddisk:/no-config
the file no-config is just a non existent file, you can give any name here really.
Step 2
And issue 'sync', this will make the change persistent in the rommon config vars.
rommon> sync
Step 3
Issue 'i' or 'reset' and when the rsp is booting up, it should ignore the config file, since there's no config file found on /harddisk: called no-config
rommon> reset
or
rommon> i
Overriding the ADMIN configuration in XR:
In Admin configuration we store all the local usernames and passwords.
Step 1
Similarly you can do the same thing for admin config:
IOX_ADMIN_CONFIG_FILE=/disk0:/none
You should get prompted for root user/pass and will have a blank config on the box.
You need to load your config and do your modification.
Step 2 and 3
are the same as for the base xr config file.
Second Option
Another way of recoveryof the password is to enable the following again in rommon:
rommon> AUX_AUTHEN_LEVEL=0
Which will allow the aux port to drop to ksh upon the RSP bootup with no prompt for login.
At the prompt you can either type:
/pkg/bin/exec -a
Which will give you a router prompt: Or simply
# Config
Which drops you into EXEC config mode.
Example
# uname -a
QNX node0_RSP0_CPU0 6.4.0 2009/12/10-13:43:22PST asr9k ppcbe
# config
RP/0/RSP0/CPU0:RO-A(config)#exit
#
# /pkg/bin/exec -a
RP/0/RSP0/CPU0:RO-A#
RP/0/RSP0/CPU0:RO-A#
RP/0/RSP0/CPU0:RO-A#exit
#
Clean up
Make sure that after you're done with your changes, in case you made the rommon vars persistent, you may want to unset
the variables to get back to the normal files that are used.
rommon> unset IOX_ADMIN_CONFIG_FILE
rommon> unset IOX_CONFIG_FILE
rommon> sync
All set!
If you forget the cleanup, you might see these lines:
RP/0/RSP1/CPU0:Oct 28 07:18:37.141 : locald_DSC[301]: %SECURITY-LOCALD-3-LWA_ADD_FAIL : Failed to add the username admin to lightweight authentication password database: No such file or directory
Related Information
It has been seen that sometimes a system autonomously enters password recovery mode. This is identified with:
“enter root-system username”
This is due to a ddts known as CSCth03923
You end up providing what you think is a known username and password combination and it failes to get you in.
The solution is simple, just enter a fake username/password that you know for sure has not been configured yet and you're in!
Xander Thuijs - CCIE #6775
Sr Tech Lead ASR9000。