Resetting Admin Password

This section describes how to reset the password for the default administrator user account (admin) on the managed device. Use this procedure if the administrator user account password is lost or forgotten.

1. Connect a local console to the serial port on the managed device.
2. From the console, login into the managed device as a password recovery user. For information, read Password Recovery user.
3. Enter configuration mode by typing in configure terminal.
4. To reset the administrator user account password, use the mgmt-user admin root command.
5. Enter a new password for this account and retype the same to confirm.
6. Exit from the configuration mode and the user mode.

If you have defined a management user password policy, make sure that the new password conforms to this policy. For details, see Implementing Specific Management Password Policy.

The following is an example of how to reset the admin password as a default password recovery user. If you have configured an alternate password recovery user, use its credentials to login to the controller. The commands in bold type are what you enter:

User: password

Password: forgetme!

(host) #configure terminal

Enter Configuration commands, one per line. End with CNTL/Z

(host) (config) #mgmt-user admin root

Password:

Re-Type password:

(host) (config) #exit

(host) #exit

Password Recovery user

A password recovery user is a management user with root rights that is used to reset the admin password in the event of a lost or forgotten password. Starting with ArubaOS 8.4.0.0, a configurable alternate password recovery user can be created in addition to the default password recovery feature.

Note: Password recovery access using either the default password recovery user or the alternate password recovery 
user is allowed only through the serial console of a controller.

Note: Password recovery users can be configured only through SSH sessions and serial console sessions with a 
controller and not through WebUI.

Note: Aruba recommends to enable the default password recovery user before generating and sharing the tech-support 
logs or configuration files with customer support.

Note: It is recommended that either the default password recovery user is disabled or the alternate password 
recovery user is configured when setting up the network to ensure. This is to ensure that there are no 
vulnerabilities.

password all
aaa authentication local-user "admin" group "Level-15"
aaa authentication local-user "admin" group "Level-15" password plaintext
New password for admin: **********
Please retype new password for admin: **********

no aaa authentication local-user localuser
no password operator
password manager

Access Security Guide 2930F