7063-CR1 HMC repeatedly prompts to change password on new arrivals from manufacturing for install at 940

Troubleshooting

Problem

During a new install of an HMC received from manufacturing, and first logging into the HMC via the enhanced GUI with the default username and password, the user is immediately prompted to change the default password due to expiration. This behavior is normal and a new feature that complies with new appliance security laws. The design is to force the admin to set a new password immediately for security reasons to prevent any default known password from existing for "login" default users after the installation.

However, upon setting a new password, the user is prompted again to change the password. This sequence repeats and prevents the user from accessing the HMC.

Symptom

Here is an example of the sequence of steps the user goes through when this problem is present:

1) Attempts to access the HMC with the default username and password.

2) When prompted to provide a new password, provides one.

3) The HMC resets the login panel for the user to log in with the new password.

4) Once the user attempts login, the user is prompted again to change the password.

Cause

The cause of the problem is an incorrect date and time on the HMC, in particular, the date will be set to Jan 1st, 1970. This is a result of the HMC being impacted by the problem documented here:

https://www.ibm.com/support/pages/node/1288780

Environment

All HMCs manufactured in December 2019, that are powered on, in a future month may be impacted.

Diagnosing The Problem

If unable to access the HMC due to repeated prompts to change the password due to expiration, verify if the system time is set to Jan 1, 1970:

If user is remote in BMC: Go to Power Control -> Set Power Reset

If user is local, power off and on the HMC

Enter the petitboot menu:

Select Exit to shell

In the shell run the following commands:

date ipmitool sel time get

Example output:

The date in the output of one or both commands are incorrect, often a day in January 1970. The important point to note is that the year is 1970, this will cause issues on the HMC.

Resolving The Problem

From the petitboot shell, use the date command to set the correct date and time, in UTC. Follow the format provided in the examples:

date -s YYYY.MM.DD-HH:MM

Example command and output:

Use the ipmitool command to set the sel time to the new date.

ipmitool sel time set now

Example command and output:

Verify that the ipmitool and date commands now show the correct values.

ipmitool sel time get

date

Example output:

Type exit to return to the petitboot menu.

Reattempt accessing the HMC via the "login" screen.

Workarounds

The following alternate login method can be used to work around the problem:

1) When at the UI login prompt, switch to command-line mode by entering Ctrl-Alt-F4.
2) At the login, enter the userid, hscroot, and for password enter abc123 or the last password attempted from the UI.
3) If prompted to change the password, provide a password. It can be the same attempted last. It cannot be abc123 and must be a minimum of 8 characters in length.
4) Once logged in successfully, type exit, and press Enter.
5) Press Ctrl-Alt-F2 to return to the UI.
6) Login from the UI with the same credentials established in the CLI.

NOTE: It is highly recommended that the correct date and time be set and the HMC rebooted after to prevent impacting subsystems that rely on a correct date and time to operate.

Document Location

Worldwide

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"7063-CR1","label":"Hardware Management Console (7063-CR1)"},"Component":"New Install","Platform":[{"code":"PF041","label":"HMC"}],"Version":"v9r1.940","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}}]

Tips