Recovering a Router with the Password Recovery Service Disabled
Recovering a Router with the Password Recovery Service Disabled
Password recovery is a process used to restore to working order a Cisco router which is no longer administratively accessible (e.g. the correct credentials to log in have been forgotten). The process enables anyone with access to the physical console to interrupt the boot sequence of the router, forcing it into ROM monitor mode (rommon). From rommon, the router can then be instructed to boot without referencing its startup-configuration, so the user can access privileged exec (enable) mode at the console and retrieve or modify the saved configuration.
Obviously, this means anyone with physical access to the device can view the potentially sensitive router configuration. Cisco provides the ability to disable the password recovery service to mitigate such physical attacks.
Disabling Password Recovery
Disabling the password recovery service is performed similar to disabling any other IOS service, with a derivation of the no service command. Note, however, that this particular command has been omitted from the context sensitive help due to its potentially dangerous nature.
Router(config)# no service password-? password-encryption Router(config)# no service password-recovery WARNING: Executing this command will disable password recovery mechanism. Do not execute this command without another plan for password recovery. Are you sure you want to continue? [yes/no]: y Router(config)#
The line no service password-recovery will appear in the running configuration at this point. The command itself is somewhat peculiar: it will persist across reloads without being written to the startup configuration (similar to manipulating the configuration register), but is displayed in the running configuration regardless.
On the next reload, a notice regarding the disabled password recovery service can be seen.
System Bootstrap, Version 12.3(8r)YH8, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2006 by cisco Systems, Inc. C1800 platform with 131072 Kbytes of main memory with parity disabled Upgrade ROMMON initialized PASSWORD RECOVERY FUNCTIONALITY IS DISABLED program load complete, entry point: 0x80012000, size: 0xc0c0 Initializing ATA monitor library....... program load complete, entry point: 0x80012000, size: 0xc0c0 ...
Recovering a Device Without the Password Recovery Service
At this point, you may be wondering what recourse you're left with should password recovery need to be performed. Fortunately, even with password recovery disabled, a forgotten password won't turn your router into a brick. Although you won't be able to access rommon, you do have the option of erasing the startup configuration by sending a break signal during boot.
System Bootstrap, Version 12.3(8r)YH8, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 2006 by cisco Systems, Inc. C1800 platform with 131072 Kbytes of main memory with parity disabled Upgrade ROMMON initialized PASSWORD RECOVERY FUNCTIONALITY IS DISABLED program load complete, entry point: 0x80012000, size: 0xc0c0 Initializing ATA monitor library....... program load complete, entry point: 0x80012000, size: 0xc0c0 Initializing ATA monitor library....... program load complete, entry point: 0x80012000, size: 0x167e724 Self decompressing the image : ################################################# ################################################################################ ################################################################ [OK] Restricted Rights Legend Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013. cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706 Cisco IOS Software, C181X Software (C181X-ADVIPSERVICESK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Thu 26-Feb-09 03:22 by prod_rel_team [ Send the break signal at this point ] PASSWORD RECOVERY IS DISABLED. Do you want to reset the router to factory default configuration and proceed [y/n] ? y Reset router configuration to factory default. This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to [email protected]. Installed image archive Cisco 1811W (MPC8500) processor (revision 0x400) with 118784K/12288K bytes of me mory. Processor board ID FHK110913UQ, with hardware revision 0000 10 FastEthernet interfaces 1 Serial interface 1 terminal line 125440K bytes of ATA CompactFlash (Read/Write) [OK][OK] SETUP: new interface FastEthernet0 placed in "shutdown" state SETUP: new interface FastEthernet1 placed in "shutdown" state Press RETURN to get started! *Oct 10 04:41:15.971: %SYS-5-RESTART: System restarted -- Cisco IOS Software, C181X Software (C181X-ADVIPSERVICESK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Thu 26-Feb-09 03:22 by prod_rel_team ... *Oct 10 04:41:18.503: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet3, changed state to down *Oct 10 04:41:18.503: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet2, changed state to down Router> enable Router# show startup-config Using 5 out of 196600 bytes end
At this point you're able to restore the device's configuration (minus the forgotten credentials) from a backup.
One last note: attempting to manipulate certain fields of the configuration register while password recovery is disabled will result in an error.
Router(config)# config-register 0x2142 Password recovery is disabled, cannot enable diag or ignore configuration. Router(config)# service password-recovery Router(config)# config-register 0x2142 Router(config)#
原帖地址：http://packetlife.net/blog/2010/oct/11/recovering-no-service-password-recovery-service/