Unix Tip: Recovering control of a firmware password protected system

Send in your Unix questions today! |
See additional Unix tips and tricks

Firmware passwords can be a very useful security measure when you need to keep systems stable in spite of the fact that they may be exposed to unauthorized individuals, but they can also present a time-consuming challenge if you acquire such a system and don't know the password that was set or if you forget. Having recently purchased some used Sun systems off eBay, I quickly discovered that one of the systems had been configured with a firmware password that the seller didn't know, so I was forced to find a way to overcome this security setting before I could attempt to take control of the system and reinstall it.

For some systems, a forgotten firmware password is not especially troublesome. If you know the root password and the system will boot, you can boot the system and use the eeprom command to change the security settings that make the firmware password active. To inactivate a firmware password, set the security mode to "none" with this command:

# eeprom security-mode=none

The eeprom command, /usr/sbin/eeprom, is used to display or change the values of parameters stored in the EEPROM on your system.

Of course, if the security mode is set to full, you will not be able to issue to boot command without knowing the firmware password. If this is the case with your system and/or you don't know the root password, gaining control can require some messy intervention. I ended up repowering the system, then pulling out and then reseating the system's NVRAM. At this point, the settings were lost. I was able to boot from CD and reinstall the system. I also had to reprogram the NVRAM. My MAC address, for example, which had reverted to all zeroes, needed to have a legitimate address. If you are able to capture the system's original MAC address before you yak and replace the NVRAM, you can put it back using a procedure written up on www.squirrel.com. The following commands would set the MAC address and hostid of the system to 8:0:20:c0:ff:ee and 57c0ffee. The machine type in this example refers to an IPX -- a Sun system dating back to the mid 90's -- so you might want to first determine the correct system type for your system. Keep in mind, too, that you won't want to use the MAC address 8:0:20:c0:ff:ee for more than one system on your network.

1 0 mkp
real-machine-type 1 mkp
8 2 mkp
0 3 mkp
20 4 mkp
c0 5 mkp
ff 6 mkp
ee 7 mkp
0 8 mkp
0 9 mkp
0 a mkp
0 b mkp
c0 c mkp
ff d mkp
ee e mkp
0 f 0 do i idprom@ xor loop f mkp

In my case, I was installing the Sparc system for use on my home network and I wanted Solaris 10. Once I got past the firmware password problem, the rest of the install went smoothly and the system is running well. You can sometimes acquire Sun systems (e.g., Netra X1s, SunFire V100s, SunBlades and such) for between $20 and $100. If you would like a Solaris playground to learn things you might not have an opportunity to try on production systems at work, you might get some good buys on eBay. Just be prepared. You may have to wrestle with some of your wins before you can put them into service.