Resetting the Firmware Password on SUN Netra t1 105

In short: remove HostID board, boot FreeBSD, re-plug HostID board into running server, type
eeprom security-mode=none

From Sun's own User and Administration Guide from Jan 2000:

The Netra t1 Model 100/105 computer system is a single-processor server designed primarily for use by telecommunications carriers and internet service providers.

This seems to have caused the fortunate side-effect that these boxes run forever. They can still be bought on e.g. ebay.

If the seller forgot to check for it, the used/refurbished machines may happen to be locked down with

security-mode=full
security-password="..."

rendering the system basically unusable.

Various suggestions as to how to reset this float around on the Internet, such as

Pressing ESC during the boot/selfcheck process.

Did not help

Removing the on-board battery, connecting the pins on the board, wait a few seconds for some memory fall to all-zeros.

Did not help. Cannot work, because the settings are in EEPROM.

The ultra-helpful persons at the local Hackerspace helped me find the HostID board. This is a small board with an Atmel 24C01A EEPROM chip which holds among other things the machine's MAC address.

The solution

The machine starts up without this chip even tough it complains about a missing/corrupted ID. And the OpenBootPrompt does not ask for a firmware password. I could boot disk into FreeBSD. So the HostID board seems to contain the security settings as well.

OK, even if the eeprom can reset the security-mode there is no chip to store it, as i just removed it. I got the additional information that the HostID board is connected by I²C bus, and that inserting the board into the running server would most likely not damage anything. So i did just this and ran eeprom security-mode=none. After a reboot the firmware password-problem was solved.

Sun, 29 Jun 2025
[/projects] permanent link