CSSM Password Recovery Process (On-Prem-CLI)
What is CSSM?
Cisco Smart Software Manager (CSSM) is a centralized platform used to manage Cisco’s smart licensing system. It is a modern solution that replaces the traditional Product Authorization Key (PAK) based licensing model.
Key features include:
- Centralized Management: Allows you to track licenses for all Cisco products across your organization from a single interface.
- Flexibility: Licenses are not tied to specific hardware; they can be easily transferred from one device to another.
- Visibility: You can monitor active licenses, upcoming expirations, and usage rates in real-time.
- Two Deployment Models: * Cloud: Management directly through the Cisco portal.
- On-Prem: Management via a local server for secure, air-gapped networks.
How to Perform a Password Recovery
Step 1: Powering Off and Detaching the Disk from the CSSM Virtual Machine on vCenter
As the first step of the process, we begin by safely powering off the CSSM machine hosted on the vCenter server to prevent data loss. Once the machine is shut down, we proceed by detaching its virtual disk.
Step 2: Mounting the detached VMDK file to any Linux machine
After detaching the disk, we mount the VMDK file to a separate Linux virtual machine to access the file system.
Step 3: After logging into the Linux machine, we view our vgl-lv_root file using the lsblk -f command.
Step 4: Creating a new directory with sudo mkdir /mnt/ssm
Get ahmetrecber’s stories in your inbox
Join Medium for free to get updates from this writer.
Step 5: Mounting the Logical Volume with sudo mount /dev/mapper/vg1-lv_root /mnt/ssm/
This command mounts the root partition of the CSSM disk into the /mnt/ssm directory. It allows you to access and modify the files of the offline CSSM system through this folder.
Step 6: Verifying the content with ls /mnt/ssm/
After the mounting process, you can verify the directory structure by running ls /mnt/ssm/. This command confirms that you have successfully accessed the CSSM's root file system.
Step 7: Entering the Chroot environment with sudo chroot /mnt/ssm/
By running this command, we change the root directory of the current shell process to /mnt/ssm/. This effectively makes the Linux machine think it is operating directly within the CSSM's own operating system, allowing us to execute internal commands as if the CSSM were running.
Step 8: Resetting the admin password with passwd admin
Since we are now in the chroot environment, running the passwd admin command allows us to directly change the password for the "admin" user within the CSSM system. Follow the prompts to enter and confirm your new password.
Step 9: Ensuring SELinux Context with touch /.autorelabel
Since we modified the password file from an external environment, the SELinux security contexts might be mismatched. Creating a hidden file named .autorelabel in the root directory forces the system to relabel the entire file system during the next boot, ensuring that the new password and system files are correctly recognized by the security policy.
Step 10: Exiting the Chroot and Unmounting the File System exit Then, execute sudo umount /mnt/ssm
First, run the exit command to leave the chroot environment and return to the host Linux shell. Then, execute sudo umount /mnt/ssm to safely unmount the CSSM disk. This ensures that all changes are written to the disk and the file system remains consistent before you detach it.
Step 11: Finalizing the Recovery and Restarting the System
Finally, detach the disk from the Linux machine and re-mount (attach) it back to the original CSSM virtual machine on vCenter. Once the hardware configuration is restored, power on the CSSM machine. You can now proceed by logging in with your newly set password.
Thank you for reading, I hope this guide helps you resolve your CSSM access issues.
