Ever had the need to reset your forgotten "root" password on an AIX server? Ever been frustrated by the lack of complete information on the subject? Well, stick around and we will walk you through one way (perhaps the best way) to recover from this problem.

Prepare the NIM Server

Shutdown the LPAR

Boot the LPAR in SWS (Service Mode)

Boot Single-User Mode from the NIM

Reset the Password

Verify the Results

One day, while performing my normal administrative duties on UNIX servers, I found that I could not log into a server as the "root" user. So, after trying every possible password that we could think of, we found ourselves without "root" access. Hmmmmmm, I thought, what an unusual problem. Yeah right; in the crazy world of IT, this problem is more common than you might think. Well, after looking for information on the topic, we found what we needed on IBM's web site. However, as usual, the article presumed a certain level of knowledge, that fortunately we had. We realize that not everyone may not always have this knowledge, so once again we will elaborate. We also wanted to document this procedure for ourselves, in the event we had to perform this quickly in the future. Another good result of such documentation is that it can be used to train other UNIX systems administrators so that they can react quickly to this problem.

For this article the assumptions might be a bit obvious. We assume that you have solid AIX experience as well as pSeries LPAR and NIM (Network Installation Management) server experience. Certainly all of this knowledge is necessary from conceptional standpoint is absolutely necessary.

Technical requirements are as follows:

• Access to the AIX server console. We are using the Web-based System Manager". "Root" access.

• A NIM server with "root" access.

• Web-Based System Manager Remote Client is installed on your workstation.

• An SSH terminal emulation package. We are using PuTTY.

Now that we have laid the groundwork, let's get going with the actual steps.

Single-User access to an AIX system can be attained by booting form CDROM or from a NIM server. If using a NIM server as we are, steps must be taken to "allow" the maintenance boot. This is perhaps a security issue and this maintenance boot is granted as one-time only. If another boot is required, another NIM server preparation must occur. The best way to allow a maintenance boot is by simply executing these two commands, which (1) resets the current maintenance boot for the server with NIM, and (2) requests that the server (cjdvioa06) be allowed a maintenace boot using the NIM server.

	      
nim -o reset -a force=yes cjdvioa06
nim -o maint_boot cjdvioa06
	      
            

Log into your server, or LPAR as in our case, as shown here. This of course requires that you have successfully installed the Web-Based System Manager Remote Client on to your desktop.

Once the handshaking is complete, log in.

Depending on the speed of your network connection, this could seem as though it takes forever.

Now expand the gui as shown and highlight the server of interest.

Right click on the highlighted server and select Shut Down Partition as shown here.

It seems best to allow the operating system the opportunity to shut down gracefully. Choose Operating System and click OK to continue.

After a few moments, you should see that the state is "Not Activated". The server is down.

Once again right click on the highlighted partition. This time select Activate.

On this screen we need to click Open a terminal window.... and then click the Advanced button.

In the Advanced dialog box select SMS as our Boot mode and then click OK to continue.

Click OK to boot the system in maintenance mode.

Very shortly you should see the following screen. Select 5 and carriage return to begin the laborious process of booting single-user mode.

Enter a 1 and a carriage return to continue.

We are booting over the network so enter a 6 and a carriage return to continue.

Here you simply need to know which adapter is connected to your NIM server network. Ours is 2 as we have entered, and a carriage return to continue.

Enter a 3 here for Service Mode Boot, and a carriage return to continue.

One last chance to abort, or enter a 1 to continue.

If withing a few moments, you see a screen like the following, all is well. "Packet Count" is always a good sign when network booting.

Here enter a 1 for VT100 mode.

Here enter a 1 for English.

We want to change a password. This invlolves a file (/etc/passwd) in the root volume group. We select 1 here to access rootvg.

Ignore the warning by entering 0 to continue.

Select the appropriate volume group. We currently only have one. Must be it!!!!

Chose 1 to mount the file systems and get shell access.

Now, change the password and resync the filesystems. The also reboot. Notice the account we are resetting the "padmin" account, not "root". This is because the server we are working on is a VIO server, and direct "root" access is not permitted. All login is performed as "padmin". This is irrelavent and you can feel free to substitute "root".

You should see the system rebooting as shown.

Reboot looks clean; time to proceed. All is well to this point. Almost finished.

Let's use PuTTY to make an ssh connection to the server. Notice that when we log in as "padmin" with our new password, we are immediately forced to change it again. This is something native to AIX; probably security-related. So we change it and we are granted access. Now we are finished.

We have now thoroughly explained this process, probably more so than anyone else. Hopefully we have solved your particular problem, but if not please feel free to drop us a line and we will address it as time allows.

As it turns out, as we are busy working on the HTML/CSS/php/Java Script formatting of our articles, pretty printing is not yet possible. We are working on it at a low priority.