System information

Troubleshooting Security Implementations 24-479
Recovering a Lost Password
Recovering a Lost Password
This section describes the procedures required to recover a lost login or enable password. The
procedures differs depending on the platform and the software used, but in all cases, password
recovery requires that the router be taken out of operation and powered down.
If you need to perform one of the following procedures, make certain that secondary systems can
temporarily serve the functions of the router undergoing the procedure. If this is not possible, advise
all potential users and, if possible, perform the procedure during low-use hours.
Note Make a note of your password and store it in a secure place.
All the procedures for recovering lost passwords depend on changing the configuration register of
the router. Depending on the platform and software you are using, this will be done by reconfiguring
the router software or by physically moving a jumper or DIP switch on the router.
Table 24-11 shows which platforms have configuration registers in software and which require that
you change the jumper or DIP switch position to change the configuration register.
CHAP is misconfigured Step 1 Use the show running-config privileged exec command to make sure the
router is configured for CHAP authentication. The router configuration
should include the following interface configuration commands for each
async interface that should use CHAP authentication:
encapsulation ppp
ppp authentication chap
ppp use-tacacs
Step 2
If the commands are not present, add them to the configuration.
In the following example, asynchronous interface 1 is configured to use
TACACS for CHAP authentication:
interface async 1
encapsulation ppp
ppp authentication chap
ppp use-tacacs
No CHAP supplementary file
defined on XTACACS server
Step 1 Check to see whether there is a CHAP supplementary file defined on the
XTACACS server. This file should be located in the xtacacsd directory.
Step 2 If there is not a CHAP supplementary file, create one. The file should
contain a list of usernames and cleartext CHAP passwords in the following
format:
user:#:#:ARAP password:CHAP password
Note: You cannot use /etc/passwd with CHAP.
Step 3 After the supplementary file is created, restart the XTACACS daemon with
the following command:
xtacacsd -s -l -f supplementary-filename
Username and password not in
/etc/passwd
Step 1 Make sure that the appropriate username and password pairs are contained
in the /etc/passwd file.
Step 2 If the appropriate users are not specified, generate a new user with the
correct username and password using the add user command.
IP connectivity problem For information on troubleshooting IP connectivity, see Chapter 24,
“Troubleshooting Security Implementations.”
Possible Problem Solution