Junos Password Recovery: Root Password Reset Guide

Losing the root password on a Juniper device (EX, QFX, MX, SRX) does not mean a factory reset - Junos ships with a password recovery path designed for exactly this situation. There are two practical methods: booting into single-user mode to edit the password database directly, and the newer amnesiac boot option that resets the configuration but preserves the system. This guide covers both, with exact boot-menu interactions and the commands to set a new root password.

Method 1: Single-User Mode Recovery (Classic)

1. Connect via console and reboot the device: request system reboot
2. At the boot menu, interrupt the autoboot by pressing a key (usually space or any key within 10 seconds).
3. At the loader prompt, boot into single-user mode:
   loader> boot -s
4. The system boots to a single-user shell. Enter full path to shell: /bin/sh
5. Remount the root filesystem read-write:
   mount -u /
6. Edit the password file to remove the root password hash:
   vi /etc/master.passwd
   Delete the hash from the root entry (between the colons).
7. Rebuild the password database:
   pwd_mkdb /etc/master.passwd
8. Reboot: reboot
9. Log in as root with no password and set a new one:
   root@% cli
root@# set system root-authentication plain-text-password

Method 2: Amnesiac Boot (Modern, Cleaner)

Newer Junos versions (12.1+ on most platforms) offer a recovery option from the boot menu:

1. Reboot and interrupt the boot at the loader prompt.
2. Select the kernel entry and append the amnesiac option, or choose the boot menu item "Recover root password" where available.
3. The device boots with an empty configuration (amnesiac) - no root password, no interfaces configured.
4. Set a new root password and rebuild the configuration from your backups.

Amnesiac wipes the active configuration - only use it when you have a config backup or can reconstruct the box.

Prevention: Auto-Recovery Configuration

set system auto-recovery
set system root-authentication encrypted-password "..."

set system auto-recovery makes the device auto-recover (reset root password to the configured value) after a recovery boot - useful for devices without console access in remote sites.

Important Notes

• Both methods require console access - recovery cannot be done over SSH.
• Editing /etc/master.passwd on modern Junos also requires mount -u / and sometimes remounting /var and /config; use mount -a if unsure.
• On SRX with security policies blocking console traffic, disable the security policy or use the amnesiac method.
• After recovery, verify with show system users and re-check show configuration system.

Related: Juniper EX initial setup and Cisco IOS password recovery.

原文链接：https://kb.juniper.net/InfoCenter/index?page=content&id=KB16451