Replacing firmware when password not known

[PaulWebster]

This old post shows how to set it

Set root password to failsafe mode in custom firmware image

Hi everyone, I would like to know if it's possible to set a password to the root user in failsafe mode when generating customized firmware images, this way we can be sure nobody can easily take a device, put it in failsafe mode, log in as root via SSH, reconfigure the password, mount the root and inspect the contents of the firmware, which in the case of firmwares generated for OpenWISP contain a secret token that is used by openwisp-config to automatically register the device in a specific org…

In “normal” OpenWrt failsafe … is OpenWrt operating as tftp client or as server? I thought Server but I can’t get a response.