Junos OS

Hey All,

I have  an EX2200-C that I don't have the password for.  I'm trying to reset the password by rebooting, hitting the space bar and typing "boot -s".  however, instead of getting to a prompt type in recovery and begin the password reset procedures.  It just runs through a boot process and then reboots, landing me back at a login prompt.

Any ideas?  Thanks

Hi  Folks,

This is the usual way to recover...

1. Connect a console cable to the Master EX Switch.
2. Power Off.
3. Reboot the box.  Watch as the system boots, and press the 'spacebar' at the "Loading /boot/defaults/loader.conf" to get a command prompt.  Enter 'boot -s' at the prompt to boot into single-user mode as shown:
   

   FreeBSD/PowerPC U-Boot bootstrap loader, Revision 2.1
(marcelm@apg-bbuild01.juniper.net, Wed Feb 6 11:23:55 PST 2008)
Memory: 1024MB
Loading /boot/defaults/loader.conf                                   <--------------
/kernel data=0x9ec818+0x6eb6c syms=[0x4+0x888e0+0x4+0x8f04d]

Hit [Enter] to boot immediately, or space bar for command prompt.    <--------------

<user presses spacebar>

loader> boot -s
Kernel entry at 0xa0000100 ...
GDB: no debug ports present
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1996-2008, Juniper Networks, Inc.
All rights reserved.
Copyright (c) 1992-2006 The FreeBSD Project.


4. The system performs a single-user boot-up process and prompts the user to run the recovery script, enter a shell pathname or press enter for a default shell.  Press enter at this point.
   

   Mounted jbase package on /dev/md0...
System watchdog timer disabled
Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh:

<user presses enter>


5. This will put you at a (#) prompt.  At this point, mount the filesystem.  Create a temporary directory and move the existing configurations to the temporary folder you created.  Type 'exit' to continue the boot process.  The commands are listed below: 
   

   mount -a
mkdir /config/temp
mv /config/*.gz /config/temp
shutdown -r now

6. Since there are no configuration files in the /config directory the switch boots to a factory default configuration.  At this point you can log in as the root user without a password. Use the 'load override' command to recall your previous configuration. Set the new root password and the system is recovered upon a commit. The commands are listed below: 
   

   Creating initial configuration...mgd: error: Cannot open configuration file: /config/juniper.conf
mgd: warning: activating factory configuration
mgd: commit complete
mgd: ----------------------------------------------------------
mgd: Please login as 'root'. No password is required.
mgd: To start Initial Setup, type 'ezsetup' at the JUNOS prompt.
mgd: To start JUNOS CLI, type 'cli' at the JUNOS prompt.
mgd: ----------------------------------------------------------
Setting initial options: debugger_on_panic=NO debugger_on_break=NO.
Starting optional daemons: .
Doing initial network setup:.
Initial interface configuration:
additional daemons:.
savecore: could not be determined
savecore: no dumps found
Additional routing options: ipsec kld.
Doing additional network setup:.
Starting final network daemons:.
setting ldconfig path: /usr/lib /opt/lib
starting standard daemons: cron.
Local package initialization:.
starting local daemons:.

Thu Aug 13 09:50:55 UTC 2020

I can get all the way to the point of typing in "boot -s" at the loader> prompt.  However, after hitting enter, it just does a regular boot and reboots itself into a login prompt. 

Hi Folks,

What is your Junos?

currently 15.1r6.7

I am in the process of downgrading to 14.1x53-d44.3 to see if that helps....

Hi Folks,

To add my 2 cents on this…

On EX2200/EX3200/EX3300/EX4200/EX4500 and EX4550 platform, type "boot -s" from loader prompt can start up the system in single-user mode. The user can setup the password recovery in that mode. If  "boot -s" is typed under loader in 15.1R1 ~15.1R6, the system does not go into the single-user mode but reboot from the alternate slice.

Workaround

As a workaround, remove "boot_unattended" environment variable from NVRAM. The removal is temporary. The change does not persist after the password recovery.

Please follow the following steps:

1. Get into u-boot prompt (=>) by pressing [Ctrl + C] key combination at the beginning of the system boot process.

U-Boot 1.1.6 (Feb  6 2008 - 11:27:42)

Board: EX4200-24F 2.20

EPLD:  Version 6.1 (0x85)

DRAM:  Initializing (1024 MB)

FLASH: 8 MB

USB:   scanning bus for devices... 2 USB Device(s) found <<<<< Type Ctrl + C here

       scanning bus for storage devices... 1 Storage Device(s) found

=>

2. remove 'boot_unattended' environment variable

=> printenv

bootdelay=1

baudrate=9600

.

.

boot_unattended=0

.

=> setenv boot_unattended

=> printenv

.

  <<<<< /* boot_unattended is not listed anymore */

3. Then issue "boot" command, get into "loader>", boot -s will work

=> boot

Consoles: U-Boot console

Found compatible API, ver. 7

FreeBSD/PowerPC U-Boot bootstrap loader, Revision 2.1

<snip>

Hit [Enter] to boot immediately, or space bar for command prompt. <<<<< press "Space" here

Type '?' for a list of commands, 'help' for more detailed help.

loader> boot -s     <<<<<

..

System watchdog timer disabled

Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh: recovery  <<<<< enter "recovery" here

<snip>

warning: Please logout and log into the VC-M to use CLI.

{linecard:0}

root>

{linecard:0}

root> configure

Entering configuration mode

{linecard:0}[edit]

root# set system root-authentication plain-text-password

New password:

Retype new password:

{linecard:0}[edit]

root# commit

2010-01-01 00:31:54 UTC: Running FIPS Self-tests

veriexec: no signatures for device. file='/sbin/kats/cannot-exec' fsid=75 fileid=51404 gen=1 uid=0 pid=304

2010-01-01 00:31:57 UTC: FIPS Self-tests Passed

commit complete

https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1265386

The PR search tool is down now; so check the hyperlink after couple of hours...

This worked!

Thanks!

-Mike Smith

Hey there,

Here are couple of KB articles & JunOS Doc to aid resetting password on EX-Series:

https://www.juniper.net/documentation/en_US/junos9.5/topics/task/troubleshooting/ex-series-root-password-recovery.html

Password recovery procedure:

https://kb.juniper.net/InfoCenter/index?page=content&id=KB10503&actp=METADATA

EX-series Switch Password Recovery Procedure:

https://kb.juniper.net/InfoCenter/index?page=content&id=KB14102

Regards,

Karan Dhanak

#Mark my solution as accepted if it helped, Kudos are appreciated as well.