Summary
Unable to change the root password from the default root password on the Extreme 8820 platform. The root password change using the commands, “su” and “su –“, behave differently in an attempt to change the root password.
If the “su” command is used, it will report the root password change is successful, but the login to root using this changed password won’t work. If the “su –“, command is used, it won’t allow you to change the root password and throws an error message (see below Symptoms for details).
Background
The root cause is a defect in updating certain password files, “/etc/shadow” with appropriate permissions after changing the root password using “passwd” command.
Impact
There are no data plane or control plane issues, however, customers cannot use a different root password other than the default.
Products Affected
Extreme 8820
Software Affected
All versions prior to 20.5.3 and 20.5.2b that pertain to Extreme 8820 platform.
Symptoms
An attempt to change the password with fewer than four characters will be successful but can’t login with the changed password (for example: “test”) and the default password only works to login into root.
[admin@8820]# su
Password:
[root@8820]# passwd
Warning: Access to the root account may be required for
proper support of the router. Please ensure the root
password is documented in a secure location. Recovery of a lost root
password will result in downtime.
New password: test
Retype new password: test
passwd: password updated successfully
Saving password to stable storage.
Password saved to stable storage successfully.
[root@8820]#
[root@8820]# exit
exit
[admin@8820]# su
Password: test
su: Authentication failure
exit
[admin@8820]# su -
Password:
root@8820:~# passwd
Context unavailable
Environment information is not available
root@8820:~#
Solution
Updated firmware that corrects this defect, SLXOS-74158, will be available in SLX-OS 20.5.3 onwards.
Use the “fullinstall” option of the firmware download command when upgrading to ensure that the appropriate permissions are updated for the device. Once this is done, it is no longer required to use the fullinstall command for future upgrades.
Please see the full field notice article here for updates and more details.
