0

I reset my admin password with below command:

#Set system login user admin authentication encrypted-password <new password>

But now i can't login to my device, what can be the reason?

9
  • 1
    I’m willing to bet money you mistyped the password. You may have to perform a password recovery. – Ron Trunk Jun 14 '20 at 17:35
  • 1
    Have you tried turning caps lock on and then using the shift key like you normally would, in case you inverted the case of each letter? Or maybe adding a space before and/or after the password in case you maybe accidentally had one in there (if the OS doesn't strip the space characters out). – Jesse P. Jun 14 '20 at 19:31
  • 2
    @RonTrunk, I learned a long time ago to first type in the password to a text editor, then copy and paste the one in the editor. Once it works, then I can delete the password in editor. – Ron Maupin Jun 14 '20 at 22:54
  • 4
    Did you put your exact new password after encrypted-password or a hash of your new password? If you didn't provide a valid hash, the command should have failed and your old password should still work. – Teun Vink Jun 15 '20 at 6:11
  • 1
    To expand on what @TeunVink said, you need to say "authentication plain-text-password" if you expected to type the password as you would when you log in. "authentication encrypted-password" expects the encrypted password hash. – Jordan Head Jun 15 '20 at 11:17
0

When an EX Series switch is downgraded from Junos OS release 15.1 to release 12.3 after implementing any changes, such as root-authentication password change or creation of new users, the password credentials will not work due to a difference in the hashing mechanism used in the two releases.

This article indicates the difference in hashing or encryption between the two releases, and provides a workaround to make password decryption successful after a downgrade.

SYMPTOMS: When an EX Series switch is downgraded from Junos OS release 15.1 to release 12.3, the SHA-256-hashed password does not work. I'm using the correct root password, but still cannot log in This applies to both root and non-root passwords. What are the password hashing and encryption differences between Junos OS releases?

CAUSE: There is a difference in the way a plain-text password is hashed and stored as encrypted in Junos OS release 15.1 and in release 12.3 and earlier.

In Junos OS release 12.3 and earlier images, encrypting and decrypting of passwords by using SHA-256 is not supported. This is a limitation in Junos OS release 12.3. Therefore, if a password that is encrypted by using SHA-256 in Junos OS release 15.1 is provided to Junos OS releases 12.3 and earlier, the password decryption will fail.

The encryption used is as follows:

In Junos OS release 12.3 and earlier images, MD5 encryption is used and the password starts with $1$. In Junos OS release 15.1 image, SHA-256 encryption is used and the password starts with $5$. In Junos OS release 17.2 and later images, SHA-512 encryption is used and the password starts with $6$. Behavior in Junos OS release 12.3 In Junos OS release 12.3 and earlier, when a password is configured as plain text, MD5 hashing is performed and the password is stored as encrypted text.

In MD5 hashing, passwords start with $1$:

root> show version
fpc0:
--------------------------------------
Model: ex4200-48t
JUNOS Base OS boot [12.3R12.4]

root> show configuration system root-authentication
encrypted-password "$1$ABC123."; ## SECRET-DATA  >>#### MD5 hashed; starts with $1$
Behavior in Junos OS release 15.1
In Junos OS release 15.1, when a password is configured as plain text, SHA-256 hashing is performed and the password is stored as encrypted text.

In SHA-256 hashing, passwords start with $5$:

root> show version
fpc0:
-------------------------------------
Model: ex4200-48t
Junos: 15.1R6.7

root# ...system login user user1                        
uid 2009;
class super-user;
authentication {
encrypted-password "$5$ABC123"; ## SECRET-DATA  >>####SHA-256 hashed; starts with $5$
}

SOLUTION: This is a limitation in Junos OS 12.3 and earlier.

Before downgrading to Junos OS release 12.3, make sure to check that the encrypted passwords are stored as MD5 hashed passwords.

root@switch> show configuration system root-authentication
encrypted-password “$1$ABC123”; ## SECRET-DATA    >>#### MD5 hashed; starts with $1$

Workaround: Check whether the password is hashed to MD5 (password starts with $1) or SHA-256 (password starts with $5). If the password is hashed to SHA-256, then configure a new root authentication or configure new user credentials with MD5 hashing as shown below:

Syntax

set system login user test class super-user authentication encrypted-password "MD5 hashed encrypted password" Example

root#set system login user test class super-user authentication encrypted-password “$1$ABC123”
root#commit

MD5-hashed encrypted passwords can also be obtained by configuring a plain-text password in any device that is running Junos OS release 12.3 or by looking up the device configuration file. Users who are authenticated via RADIUS/TACACS+ servers will not be affected after a downgrade.

{master:0}[edit]

root@switch# show system radius-server
10.10.157.3 {
    secret “$ABC123”; ## SECRET-DATA   >>Encrypted secret password   
    source-address 10.10.146.94;                             
}                                                          

reference article from https://kb.juniper.net/InfoCenter/index?page=content&id=KB31903

0

The reason you couldn't login is you set an encrypted-password which to Junos means it should've already be hashed using one of the supported password hashing algorithms, e.g. SHA256, MD5, etc.

To change your Junos password by typing it into the command-line, you should use set plain-text-password which will prompt you (twice) for the new password, then hash it for you using the default hashing algorithm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.