-
Title
Error: "The account xx does not exist." or "Invalid user xx on" on the Cisco platform -
Description
After creating an account on a Cisco IOS Switch or Router, TPAM returns errors on managed accounts"Check Password" shows[MM/DD/YYYY HH:MM:SS] Gathering the check details for managed_account on ip_address...[MM/DD/YYYY HH:MM:SS] Retrieving the password hash for managed_account on ip_address (Cisco Router (SSH) System) using funcacct ...[MM/DD/YYYY HH:MM:SS] Invalid user managed_account on ip_address[MM/DD/YYYY HH:MM:SS] Unable to connect to ip_address, or the account managed_account does not exist or is disabled.[MM/DD/YYYY HH:MM:SS] Processed the password check for managed_account on ip_address in 5 seconds"Reset Password" shows:Results from the password reset follow (all times are Server Time):[MM/DD/YYYY HH:MM:SS] Gathering the change details for managed_account on ip_address...[MM/DD/YYYY HH:MM:SS] Setting the new password for managed_account on ip_address (Cisco Router (SSH) System)...[MM/DD/YYYY HH:MM:SS] The account managed_account does not exist.[MM/DD/YYYY HH:MM:SS] An error occurred changing the password for managed_account on ip_address.orResults from the password reset follow (all times are Server Time):[MM/DD/YYYY HH:MM:SS] Gathering the change details for tpamlight on ip_address...[MM/DD/YYYY HH:MM:SS] Setting the new password for managed_account on ip_address (Cisco Router (SSH) System)...[MM/DD/YYYY HH:MM:SS] Unable to complete the query to validate the user.[MM/DD/YYYY HH:MM:SS] The account managed_account does not exist.[MM/DD/YYYY HH:MM:SS] An error occurred changing the password for managed_account on ip_address. -
Cause
When TPAM checks/resets the managed password after logging in it executes the following commands:> enable (If the user is not already in privileged mode # prompt)# term length 0# show conf
Possible causes:1/ The configuration may not have been written to the hardware NVRAM. TPAM validates the managed accounts exist using the "show conf" IOS command, rather than "show running-configuration".
2/ The functional account privilege level should be privilege 1 with the ability to enter enable mode, or privilege 15. Privilege levels 2-14 should not be set for the functional account as they cannot execute the "show conf" command
3/ Another admin is accessing the NVRAM lockng out the "show conf" command.
4/ The ENABLE password set in TPAM does not match the Cisco device -
Resolution
1/ Ensure the user configuration has been committed to NVRAM (ie.by using the 'write memory' command or "copy run start" ). Then ensure the managed account shows up when using the command "show conf".
e.g.username funcacct privilege 15 secret 5 $1$E/DQ$MnRWGSlYavHHsyLDHTID60username jamie password 7 11301E230313530E142778username karl password 7 04710D2203091B5Fusername bly privilege 15 secret 5 $1$Fr9T$vLfhFJCKaPmDVt0H2UpvV.2/ Ensure the "show conf" command ran as the functional account displays the contents of the router configuration.
If the error "% Invalid input detected at '^' marker." is returned the privilege level of the account needs to be set at 15.
3/ Ensure the "show conf" command as the functional account does not display "%% Non-volatile configuration memory is being accessed, Try again later"4/ If the functional account is privilege 1, ensure the enable password on the router, matches the one set in System | Details | Connection | Enable Password. This can be validated by running a "Check Password" on the ENABLE account.