Troubleshooting Passwords

The following procedures may be used to troubleshoot password problems:

Performing Password Recovery with an Existing Administrator

To perform password recovery for a user (administrator, installer or observer) where there exists at least one controller administrator (ROLE_ADMIN) user account, take the following steps:

  1. Contact the existing administrator to set up a temporary password for the user that requires password recovery.


    Note

    The administrator can set up a temporary password by deleting the user's account and then recreating it with the lost password. The user can then log back into the controller to regain access and change the password once again to whatever he or she desires.

  2. The user then needs to log into the controller with the temporary password and change the password.


    Note

    Passwords are changed in the controller GUI using the Change Password window. For information about changing passwords, see Chapter 4, Managing Users and Roles in the Cisco Application Policy Infrastructure Controller Enterprise Module Configuration Guide.

Performing Password Recovery with No Existing Administrator

The following procedure describes how to perform password recovery where there exists only one controller administrator (ROLE_ADMIN) user account and this account cannot be successfully logged into.


Note

We recommend that you create at least two administrator accounts for your deployment. With two administrator accounts, if one account is locked for whatever reason then the other account can be used to unlock that locked account.

    Step 1   If there are no other existing administrator (ROLE_ADMIN) user accounts, use an SSH client from your terminal to log into the host (physical or virtual) with the IP address that you specified using the configuration wizard.
    Note   

    The IP address to enter for the SSH client is the IP address that you configured for the network adapter. This IP address connects the host to the external network.

    Step 2   Enter the Linux username ('grapevine') and password when prompted.
    Step 3   On the console, enter the following command on the Grapevine root. 
    $ config_wizard

    This command starts up the Cisco APIC-EM configuration process.

    Note   

    The config_wizard command is in the PATH of the 'grapevine' user, and not the "root" user. Either run the command as the "grapevine" user, or fully qualify the command as the "root" user. For example: /home/grapevine/bin/config_wizard

    Step 4   Choose the <Create a new APIC-EM cluster> option.
    Step 5   Proceed through the configuration process until reaching the step to configure the APIC-EM ADMIN USER SETTINGS.
    Step 6   Specify a new administrator user password.
    Step 7   Reenter the new administrator user password for confirmation.
    Step 8   Proceed through the configuration wizard and its process until completion.
    Caution   

    To save the data in the Cisco APIC-EM database as part of the reset, ensure that no is chosen when prompted in HARVEST ALL VIRTUAL DISKS.

    This final step will bring down the cluster and then bring it back up again (similar to running the reset_grapvine command).

    Performing Password Recovery for the Linux Grapevine User Account

    You can use the following procedure to recover from the loss of the Linux grapevine user password. This procedure reconfigures the Linux grapevine user password that is required for accessing the host's Linux operating system.

    Before You Begin

    You should be logged into the host (physical or virtual) using a Linux console to access the Linux kernel.

      Step 1   Reboot the host (physical or virtual) while logged into the Linux console.
      Step 2   Press "e" upon seeing the GNU GRUB menu to edit the boot commands.
      Note   

      In a VMware environment, you may need to press a different key to view the GNU GRUB menu. Refer to your VMware documentation for information about access to the GNU GRUB menu. Additionally, there may be different keys to press to enter the boot sequence depending upon the BIOS used for the host.

      Step 3   Search for the line in the GNU GRUB menu output that begins with "linux" and change “ro” to “rw”, and append "init=/bin/bash" to that line.

      For example, search for this line: 

      linux /vmlinuz-3.13.0-24-generic root=/dev/mapper/grapevine--vg-root ro cgroup_enable=memory swapaccount=1 quiet sqlash $vt_handoff

      And change it to this line: 

      
linux /vmlinuz-3.13.0-24-generic root=/dev/mapper/grapevine--vg-root rw cgroup_enable=memory swapaccount=1 quiet sqlash $vt_handoff init=/bin/bash
      Step 4   Press Ctrl-x or the F10 key to proceed with the boot process.
      Note   

      We recommend that you use the F10 key to proceed with the boot process.

      At this point, the host will boot up in root mode. You can now enter the Linux passwd command to reset the password for the Linux grapevine user.

      Step 5   Enter the Linux passwd command to reset the password for the Linux grapevine user. 
      $  passwd grapevine
      Caution   

      This procedure permits you to change the Linux grapevine user password. Do not change the Linux root user password at any point in this procedure. Resetting the Linux root user password reduces the security of the host.

      Step 6   When prompted, enter a new Linux grapevine password.
      Step 7   When prompted, confirm the new Linux grapevine password by entering it a second time.
      Step 8   Enter the following reboot command to reboot the system. 
      $ /sbin/reboot -f

      The system reboots and will start up with new configuration and password.

      At the end of the reboot process, you are presented with the GNU GRUB menu.

      Step 9   Press Enter to boot up in the Ubuntu OS.
      Step 10   After booting up in the Ubuntu OS, log back into the host by entering your Linux grapevine username and password.
      Note   

      Enter the Linux grapevine password created in step 6 above.

      Step 11   Restart the configuration wizard using the following command. 
      $ config_wizard

      Proceed through the configuration wizard process by clicking next>> and accepting the pre-configured values until you reach the LINUX USER SETTINGS step.

      Note   

      The config_wizard command is in the PATH of the 'grapevine' user, and not the "root" user. Either run the command as the "grapevine" user, or fully qualify the command as the "root" user. For example: /home/grapevine/bin/config_wizard

      Step 12   When prompted to enter values for the LINUX USER SETTINGS, enter the new Linux grapevine password that you created earlier in step 6.
      Note   

      You need to start up the configuration wizard and run through the configuration process to synchronize the Linux grapevine user password to the controller itself.

      Step 13   Click next>> and continue through the configuration wizard process, until the last step of this process.
      Note   

      When prompted to enter values for the CONTROLLER CLEAN-UP step, be sure to enter no for both Harvest All Virtual Disks and Delete All Users.

      Step 14   At the end of the configuration wizard process, click proceed>> to have the configuration wizard save and apply your configuration changes to the Cisco APIC-EM.