Default Passwords and Policies

The BMC password must comply with the following policy parameters:

• Using ASCII and Unicode characters is permitted

• Minimum length: 12

• Maximum length: 20

• Maximum number of consecutive character pairs: 4

  Note

  Two characters are consecutive if |hex(char_1)-hex(char_2)|=1.

  Examples of passwords with 5 consecutive character pairs (invalid): DcBa123456AbCd!; ab1XbcYcdZdeGef!; Testing_123abcgh!.

The following is a valid example password:

• HelloNvidia3D!

A password is required to enter the UEFI menu during BlueField bootup. The UEFI menu contains various settings which impact BlueField behavior. Therefore, it is very important to keep that password secure.

Default Password

1. A first-time user accessing the UEFI menu must enter the default password for the UEFI menu, bluefield:

   

2. The user is prompted to provide a new password:

   

   Warning

   The new password entered above must be in compliance with the password policy:

   • The password must be between 12 and 64 characters (inclusive)

   • There are no requirements for upper/lower case, or special characters. Spaces are allowed.

3. The user is prompted to confirm the new password:

   

Default Password Policy

The user can enable/disable the UEFI password policy. The default password policy is enabled by default using a checkbox in the UEFI menu.

The user can browse the UEFI menu and disable as follows:

1. Navigate to "Device Configuration" > "System Configuration" > "Password Settings":

   

2. The "Default Password Policy" checkbox controls whether the more secure password policy is enabled:

   

   Note

   To disable the Default Password Policy, hit the spacebar to clear the checkbox.

3. The user must hit ESC ESC and answer "Y" to save the configuration change.

   

Disabling Default Password Policy

To disable the Default Password Policy, hit the spacebar to clear the checkbox.

Software Downgrade

The UEFI's password policy is not backward compatible. Although downgrade is not recommended, users are allowed to downgrade their software while their password is set. But , if and only if the password is set, users must configure the legacy password prior to performing any downgrade.

For BSP 4.6.0 (DOCA 2.6.0) or higher, users must change the UEFI password saved to the older "Legacy" format.

In the UEFI menu:

1. Navigate to "Device Manager" > "System Configuration" >"Password Settings" >" Set Legacy Password".

2. Select " Set Legacy Password ".

3. Enter your current password:

   

4. Type in a new legacy password between 1 and 20 characters:

   Warning

   The password format allows up to 64 characters but anything greater than 20 characters is not backward compatible.

   

5. Confirm the new password:

   

Now, you may downgrade your BlueField image.

Password Reset

To reset the UEFI menu password, users may use the ready to use capsule file EnrollKeysCap installed under /lib/firmware/mellanox/boot/capsule/EnrollKeysCap on the BlueField DPU file system. From the BlueField console, execute the following command, then reboot:

            

            
ubuntu@localhost:~$ bfrec --capsule /lib/firmware/mellanox/boot/capsule/EnrollKeysCap
        

On the next reboot, the capsule file is processed, and the UEFI password is reset to bluefield.

GRUB menu entries are protected by a username and password to prevent unwanted changes to the default boot options or parameters.

The default credentials are as follows:

The password can be changed during BFB installation by providing a new grub_admin_PASSWORD parameter in bf.cfg:

            

            
# vim bf.cfg
grub_admin_PASSWORD=’ grub.pbkdf2.sha512.10000.5EB1FF92FDD89BDAF3395174282C77430656A6DBEC1F9289D5F5DAD17811AD0E2196D0E49B49EF31C21972669D180713E265BB2D1D4452B2EA9C7413C3471C53.F533423479EE7465785CC2C79B637BDF77004B5CC16C1DDE806BCEA50BF411DE04DFCCE42279E2E1F605459F1ABA3A0928CE9271F2C84E7FE7BF575DC22935B1’
        

To get a new encrypted password value use the command grub-mkpasswd-pbkdf2.

After the installation, the password can be updated by editing the file /etc/grub.d/40_custom and then running the command update-grub which updates the file /boot/grub/grub.cfg.