Description

This article will explain how to reset the root password on QFX series with host OS (Junos runs as VM).

Symptoms

Password recovery should be performed if the password is forgotten. On QFX series with host OS (Junos runs as VM) the procedure for resetting password is different from what is listed in KB10503 [juniper.net].

Solution

  1. Make sure you have console connection to the switch, then power cycle it.
  2. At the beginning of the boot process, you will see  ”Press Esc for boot options” notification, please do not do anything and just let the process continue.
@jtac-QFX5120-48Y-8C>
{master:0}
ooting from Flash A
FPGA Reset Reason = 0x3
Primary BIOS version CBDE_P_LIG1_00.25.01
ooting from Flash A
FPGA Reset Reason = 0x83
Primary BIOS version CBDE_P_LIG1_00.25.01
Total Memory Size = 16GB
Checking Primary BIOS code integrity...Passed!
Press Esc for boot options
  1.  Then we will see the GRUB page, nothing to do here and the system will choose the first 1  “Booting `Juniper Linux'” as the default.
<snip>
ME is in normal operational state
Booting HDD00.1 (SFSA050GM3AA2TO-C-LB-24A-JUN)...
Secure boot is enforced
Welcome to GRUB!
Secure Grub2 Diskboot
                     GNU GRUB  version 2.02~juniper/rel_v4~
 
      Use the ^ and v keys to select which entry is highlighted.         
      Press enter to boot the selected OS, `e' to edit the commands      
      before booting or `c' for a command-line. ESC to return previous   
  Booting `Juniper Linux'
  1.  Next we'll see “Wind River Linux 7.0.0.9 localhost console” on the screen, when you see it please keep typing "ctrl + C" immediately, then we can get into the "Main Menu" to do password recovery. ( Post "Wind River Linux 7.0.0.9 localhost console", there will be a indication that you can interrupt the boot process with ctrl + c with only 1-2 seconds' countdown,  the time is so short that we cannot execute ctrl + c timely and the system will boot normally. So it's best to keep typing "CTRL + C" when you see "Wind River Linux 7.0.0.9 localhost console" at the first time.)
<snip>
* Starting virtualization library daemon: libvirtd
stopped /usr/bin/dnsmasq (pid 2764)
stopped /usr/bin/dnsmasq (pid 2764)                                      [ ok ]
Starting vehostd: vehostd startup
 
Starting monit daemon with http interface at [localhost:2812]
 
ind River Linux 7.0.0.9 localhost console <<<Keep typing "CTRL+C" here until we enter the Main Menu
 
ind River Linux 7.0.0.9 localhost console
 
ind River Linux 7.0.0.9 localhost console
 
  1. In "Main Menu", firstl we choose "5 [M]ore options", and then "2. Recovery mode – [C]LI" to enter the recovery mode
Choice:
Main Menu
 
1.  Boot [J]unos volume
2.  Boot Junos volume in [S]afe mode
3.  [R]eboot
4.  [B]oot menu
5.  [M]ore options <<< Choose option 5 here
 
Choice:
Options Menu
 
1.  Recover [J]unos volume
2.  Recovery mode - [C]LI <<< Choose option 2 here to enter recovery mode
3.  Check [F]ile system
4.  Enable [V]erbose boot
5.  [B]oot prompt
6.  [M]ain menu
Choice:
 
  1. We can see "Booting Junos in CLI recovery mode …", please wait until the system enters recovery cli。
 
Choice:
Booting Junos in CLI recovery mode ...
Verified /boot/manifest signed by PackageProductionECP256_2022
Verified /boot/loader.rc
Verified /boot/support.4th
Verified /boot/load-dtb.4th
<snip>
 
  1. Some notes can be seen prior to recovery cli, which explains how to reset the password
 
NOTE: Once in the CLI, you will need to enter configuration mode using
NOTE: the 'configure' command to make any required changes. For example,
NOTE: to reset the root password, type:
NOTE:    configure
NOTE:    set system root-authentication plain-text-password
NOTE:    (enter the new password when asked)
NOTE:    commit
NOTE:    exit
NOTE:    exit
NOTE: When you exit the CLI, you will be in a shell.
Starting CLI ...
 
warning: This chassis is operating in a non-master role as part of a virtual-chassis (VC) system.
warning: Use of interactive commands should be limited to debugging and VC Port operations.
warning: Full CLI access is provided by the Virtual Chassis Master (VC-M) chassis.
warning: The VC-M can be identified through the show virtual-chassis status command executed at this console.
warning: Please logout and log into the VC-M to use CLI.
{linecard:0}
root>
 
  1. Following the steps listed in part 7 to reset the password.
    • Configure the new root password
    • type exit three times to make the system reboot automatically
    • Let the system boot up normally, then we can login with the new root password
     
root> configure
Entering configuration mode
 
{linecard:0}[edit]
root# set system root-authentication plain-text-password
New password:
Retype new password:
 
{linecard:0}[edit]
root# commit
2023-04-11 07:33:46.228139 UTC: Running FIPS Self-tests
veriexec: no fingerprint for file='/sbin/kats/cannot-exec' fsid=223 fileid=49356 gen=1 uid=0 pid=16628
2023-04-11 07:33:47.225946 UTC: FIPS Self-tests Passed
commit complete
 
{linecard:0}[edit]
root@jtac-QFX5120-48Y-8C-r023#
 
{linecard:0}[edit]
root@jtac-QFX5120-48Y-8C-r023# exit
Exiting configuration mode
 
{linecard:0}
root@jtac-QFX5120-48Y-8C-r023>
 
{linecard:0}
root@jtac-QFX5120-48Y-8C-r023> exit
 
NOTE: Type 'exit' to restart the system.
# exit
Waiting (max 60 seconds) for system process `vnlru' to stop... done
Waiting (max 60 seconds) for system process `bufdaemon' to stop... done
Waiting (max 60 seconds) for system process `syncer' to stop...
  1. Let the system boot up normally, then we can login with the new root password

Modification History

2023-05 version 1