Trusted system: password resets dont work.

[Richard Pereira_1]

Hi,

I have eight 11.11 machines that are trusted. The trusted parameters are the same on all 8 boxes. I have 1 user with the same userid on all 8 boxes (no NIS). This week his password expired and he request a password reset on box A. The reset was done via SAM, and now this is what happens.

1.User logs in using temp passowrd

2.System prompts for a password change, he enters Old (temp) password, then enters a new password twice and session closes.

3. Immediatly after he opens a new session but his new passowrd is not accepted.

I have tried the following;

-done a reset twice, once it worked for me, but failed for him
-had him try another ssh client (secureCRT and putty)
-disabled pwgrd
-i even assigned him a password and although it went through without errors, it failed for him.

What I find strange is how the problem seems intermediate. I tried twice and on my second try was able to reset the password, login as the user with the temp password, assign a new password and connect using the new password. Sometimes it works, sometimes it doesnt.

What should i check for?

[Patrick Wallek]

Are any errors displayed when it doesn't work?

What does '/usr/lbin/getprpw -m lockout userid' (substitute the appropriate id for userid) show? Is the account locked? Any 1's in the getprpw output?

Have you tried 'ssh -vvv host' (that is 3 v's) when connecting to get more verbose ssh output? Also check /var/adm/syslog/syslog.log on the system you are connecting to to see if anything is logged.

[Steven E. Protter]

Shalom,

There may be a file integrity issue.

pwck
grpck

This worked for me on trusted systems for years.

SEP

[Richard Pereira_1]

grpck returns nothing


pwck returns just this
-------------------------------------
smbnull:*:101:101:DO NOT USE OR DELETE - needed by Samba:/home/smbnull:/sbin/sh
Login directory not found

webadmin:*:40:1::/usr/obam/server/nologindir:/usr/bin/false
Login directory not found

iwww:*:102:1::/home/iwww:/sbin/sh
Login directory not found

owww:*:103:1::/home/owww:/sbin/sh
Login directory not found

mysql:*:104:102::/home/mysql:/sbin/sh
Login directory not found

dummy:*:105:20::/home/dummy:/bin/false
Login directory not found
--------------------------------------------

The user is named ml16f67, i see no lockout codes in his tcb file.

/usr/lbin/getprpw -m lockout ml16f67
lockout=0000000


ml16f67:u_name=ml16f67:u_id#703:\
:u_pwd=0RjQowbx2IoNg:\
:u_auditid#65:\
:u_auditflag#1:\
:u_minchg#172800:u_exp#3888000:u_life#7776000:u_succhg#1161886177:\
:u_unsucchg#1161881953:u_llogin#7776000:u_pw_expire_warning#1209600:u_genpwd@:\
:u_restrict:u_genletters@:u_suclog#1159488355:u_suctty=pts/ta:\
:u_unsuclog#1159488351:u_lock@:chkent:

[DCE]

Try /usr/lbin/modprpw -k to reset the user account

[Sp4admin · Accepted solution]

Try this.

getprpw -r -m lockout userid
modprpw -k userid

system generated password.becare this will change the password.

modprpw -x

[Richard Pereira_1]

I tried /usr/lbin/modprpw -k and im wating for the customer to call me back to perform some tests.