Root Access on Linux-based UC appliances

There are many posts on Internet teaching you how to get root access on CUCM.  This is not a secret.  Since CUCM is Linux-based, the method is pretty straight forward - use a Linux boot CD to boot into rescue mode and modify the relevant files.  Here's a simple walk through.

Assuming CUCM was already installed.  Boot the box with a Linux installation CD (e.g. RedHat).  Type "linux rescue" in the boot prompt.

Chose language.  Default is 'English':

Choose keyboard.  Default is 'US':

We don't need to set up network.  Thus choose 'No' here.

Choose "Continue" to mount the CUCM file system.

The following message is telling you that the CUCM file system has been mounted under /mnt/sysimage.  If you want to map the root directory to the CUCM file system (which is recommended), you may use command "chroot /mnt/sysimage".

Below are the commands and explanations.

chroot /mnt/sysimage

This is to map the root directory to CUCM file system.

cd /etc

Change the working directory to /etc, where most of the system configuration files are stored.

rm securetty

Remove file protection on files "passwd" and "shadow", which stores user info and passwords.  Remove file "securetty" to allow remote connections with root.

passwd root

Reset (change) password for the root user.  Type a password that is easy for you to remember.  Retype it to confirm.  If the password was changed successfully, you'll see the prompt "passwd: all authentication token updated successfully".

Notes:

• If you typed a simple password, you might get a warning like "BAD PASSWORD: it is based on a dictionary word".  Just ignore it and retype to confirm.
• There's no screen display for the password you're typing.  Type carefully.

The following steps require some basic knowledge of the vi editor.  If you're not familiar with vi, please search Internet for vi commands help.

vi passwd

Change the passwd file so the root user has a shell (command line interpreter) to use.  Use vi commands.  Change the line

 To

Save and exit file.

For those who are not familiar with vi, here are the command sequence (case-sensitive):

1. Type /s to search for character 's'
2. Type D to delete to the end of line
3. Type A to enter append mode
4. Type bin/bash to set the shell
5. Press ESC key (it's a key on the upper-left corner of your keyboard) to exit append mode
6. Type :wq to save and exit file.

vi ssh/sshd_config

Change the sshd_config file so you can SSH as root (it's disabled by default).  Use vi commands.  Change the line

 

To

Save and exit file.

For those who are not familiar with vi, here are the command sequence (case-sensitive):

1. Type /Per to search for the word begins with 'Per'
2. Type X to delete the letter on the left (which is '#' in this case)
3. Type :wq! to save and exit this read-only file

For version 8.6 or later, Cisco use SeLinux for additional security.  You need the following:

vi /etc/pam.d/su, comment the following:
    #auth   sufficient      /lib/security/$ISA/pam_rootok.so debug
    #auth   required        /lib/security/$ISA/pam_wheel.so group=priviledged_grp

Back to command prompt and type exit command twice to reboot the system.


Use a SSH client (such as putty) to test.  You should be able to SSH into CUCM with root account.

This method applies to all Linux-based appliances such as Unity Connection, CUPS, CER, UCCX (Linux version), etc.