Description

In the event that you are unable to log in to the shell (SSH or console) of your CTP because you do not have, or cannot recall the passwords, and it is running 7.3Rx CTPOS, you can use the steps detailed in this article to enter single user mode and modify the passwords for the root user.

Symptoms

Inability to log in to the CTP shell as "ctp" or "ctp_cmd" due to "bad password" errors

Solution

Note: This procedure requires a console session to the CTP so you can interrupt the bootup process. You cannot use an SSH session.

  1. Hard boot the CTP by power cycling it.

  2. When the grub loader screen appears (this happens right after the prompt to enter BIOS at the beginning of the bootup process), press "e" to stop the boot sequence.

  3. Press the down arrow once so that you are on the line that starts with "kernel."

  4. Press "e" again to edit this line. It should refresh the screen, and then eventually stop on the grub line that states: 

grub edit> kernel /bzImage-2.4.29 ro root=LABEL=CTP_ROOT console=ttyS0,9600n8

  1. Add a space character first, add "init=/bin/bash," press Enter, and then press "b" to reboot. The "bash-4.3#" prompt appears when complete.

  2. Add the following commands:

bash-4.3# /bin/mount -n proc /proc -t proc
bash-4.3# /bin/mount LABEL=CTP_ROOT /flash_root
bash-4.3# /usr/bin/passwd
Changing password for user root.  
New password:  (‘root’ was entered)
Retype new password:  (‘root’ was entered)
BAD PASSWORD: it is based on your username
passwd: all authentication tokens updated successfully.

Note: The command above "/usr/bin/passwd" will change the password for the "root" user. You will also need to change the password for the users, "ctp" and "ctp_cmd".  To do that, type the commands: "/usr/bin/passwd ctp" and "/usr/bin/passwd ctp_cmd," respectively.

bash-4.3# cp /etc/shadow /flash_root/etc/shadow
bash-4.3# /bin/umount /flash_root
bash-4.3# /sbin/reboot -f
 

After the CTP reboots, you will be able to log in as "ctp" or "ctp_cmd" with the passwords that you submitted. If required, you can reset all the default shell user passwords with a CLI menu option (which requires the root user password). To do this refer to KB36333 - [CTP] Resetting default passwords on a 7.3R7 or 9.1R2 CTP [juniper.net] for directions.

Modification History

 

2024-08-07: Archiving this as a part of EOS Policy
2023-09-14: Initial version