By default, Cumulus Linux has two user accounts: cumulus and root.
The cumulus account:
- Uses the default password CumulusLinux!
- Is a user account in the sudo group with sudo privileges.
- Can log in to the system through all the usual channels, such as console and SSH.
- Along with the cumulus group, has both show and edit rights for NCLU.
The root account:
- Has the default password disabled by default.
- Has the standard Linux root user access to everything on the switch.
- Disabled password prohibits login to the switch by SSH, telnet, FTP, and so on.
For optimal security, change the default password with the
command before you configure Cumulus Linux on the switch.
You can add additional user accounts as needed. Like the cumulus
account, these accounts must use
execute privileged commands;
be sure to include them in the sudo group.
To access the switch without a password, you need to boot into a single shell/user mode.
You can add and configure user accounts in Cumulus Linux with read-only or edit permissions for NCLU. For more information, see Configuring User Accounts.
Enabling Remote Access for the root User
The root user does not have a password and cannot log into a switch using SSH. This default account behavior is consistent with Debian. To connect to a switch using the root account, you can do one of the following:
- Generate an SSH key
- Set a password
Generating an SSH Key for the root Account
In a terminal on your host system (not the switch), check to see if a key already exists:
root@host:~# ls -al ~/.ssh/
The key is named something like
If a key does not exist, generate a new one by first creating the RSA key pair:
root@host:~# ssh-keygen -t rsa
You are prompted to enter a file in which to save the key (/root/.ssh/id_rsa). Press Enter to use the home directory of the root user or provide a different destination.
You are prompted to enter a passphrase (empty for no passphrase). This is optional but it does provide an extra layer of security.
The public key is now located in
/root/.ssh/id_rsa.pub. The private key (identification) is now located in
Copy the public key to the switch. SSH to the switch as the cumulus user, then run:
cumulus@switch:~$ sudo mkdir -p /root/.ssh cumulus@switch:~$ echo <SSH public key string> | sudo tee -a /root/.ssh/authorized_keys
Setting the root User Password
Run the following command:
cumulus@switch:~$ sudo passwd root
PermitRootLoginsetting in the
/etc/ssh/sshd_configfile from without-password to yes.
cumulus@switch:~$ sudo nano /etc/ssh/sshd_config ... # Authentication: LoginGraceTime 120 PermitRootLogin yes StrictModes yes ...
cumulus@switch:~$ sudo systemctl reload ssh.service