topic Re: login problem in Operating System - HP-UX

login problem

M.sureshkumar — Sat, 07 Feb 2004 04:07:21 GMT

After i reactived and reset the user password,
the system is not logging.

error message is

Your password was changed by root on Thu Jan 1 00:00:00 GMT 1970
Last successful login for zztxr5: Sat Feb 7 06:44:33 GMT 2004 on ttyp2
Last unsuccessful login for zztxr5: Sat Feb 7 07:32:37 GMT 2004 on ttyp2
You don't have a password.
ulimit: Not owner
Login aborted due to no password.

Re: login problem

Sanjay Kumar Suri — Sat, 07 Feb 2004 04:34:43 GMT

Can you check the consistency of your password file with /usr/sbin/pwck.

sks

Re: login problem

M.sureshkumar — Sat, 07 Feb 2004 04:37:55 GMT

this problem for all users

Re: login problem

Jeroen Peereboom — Sat, 07 Feb 2004 04:53:05 GMT

L.S.

I found an old article:
http://www5.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000065677223
stating the ownership / protections of login, passwd and su are incorrect.

Maybe that's the case here?
What did pwck say?

What kind of system is this? HP-UX 11? Trusted?

Also check http://www5.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000067424772

Success,

JP.

Re: login problem

M.sureshkumar — Sat, 07 Feb 2004 05:05:57 GMT

hp-ux 10.20 , trusted system

Re: login problem

Bill Hassell — Sat, 07 Feb 2004 10:41:49 GMT

How did you reactivate and reset the user's password? Using SAM? Or using vi? If you use vi on a Trusted system, you need to understand the /tcb security files. Editing /etc/passwd should never be done to modify user passwords or expiration numbers. If you have replaced the user's password (*) in the /etc/passwd file with a cut-n-pastre password, you'll need to put the * back. You can read about this in man prpwd. You can also use the undocumented (at 10.20) command:

/usr/lbin/modprpw -V

which refreshes all user password expiration times. /usr/lbin/modprpw -k

Re: login problem

M.sureshkumar — Sun, 08 Feb 2004 23:22:41 GMT

This is hp-ux 10.20,Trusted system.

In SAM,modify user's password option is working fine.

suppose reactive & reset password,then login in any user's the below error message is coming for all user's

Your password was changed by root on Thu Jan 1 00:00:00 GMT 1970
Last successful login for zztxr5: Sat Feb 7 06:44:33 GMT 2004 on ttyp2
Last unsuccessful login for zztxr5: Sat Feb 7 07:32:37 GMT 2004 on ttyp2
You don't have a password.
ulimit: Not owner
Login aborted due to no password.

Re: login problem

Sridhar Bhaskarla — Mon, 09 Feb 2004 00:07:33 GMT

Hi,

This looks like a permisssions issue.

What are the permissions on your /usr/bin/passwd file?. It should have been like this

-r-sr-xr-x 5 root bin 45056 Nov 14 2000 /usr/bin/passwd

-Sri

Re: login problem

M.sureshkumar — Mon, 09 Feb 2004 00:15:47 GMT

I have attached passwd file and how to change this,

-rwxrwxrwx 1 root bin 86016 Jan 10 1998 passwd

Re: login problem

M.sureshkumar — Mon, 09 Feb 2004 01:06:19 GMT

o.k, Thanks.

Actually Password file rights problem,after changing password rights it's working fine.
old file: -rwxrwxrwx 1 root root 86016 Feb 9 11:05 passwd

changed file: -r-sr-xr-x passwd
Thanks.

Re: login problem

Jeroen Peereboom — Mon, 09 Feb 2004 06:54:43 GMT

sureshkumar,

I'm glad to try and help you.
So my suggestion to look at that old article wasn't too bad after all. I hope you read it.

It would be appreciated by me (and others too) if you assign points to answers that help. I'm glad to help you, but I also want to replace by baseball cap by something else....

Greetings

JP

Re: login problem

Bill Hassell — Mon, 09 Feb 2004 08:35:20 GMT

old file: -rwxrwxrwx 1 root root 86016 Feb 9 11:05 passwd

WOW! Someone with root privileges really messed up a crucial program file. Whenever I see 777 (-rwxrwxrwx) a red flag goes up for me. For inexperienced sysadmins, this is usually the value assigned to a file or directory to fix a problem and it is virtually always wrong. In this case, the permissions on this command may indicate a much more serious problem with security on your system. For instance, run this command:

find /usr /opt /sbin -type f -perm -002 -type f | grep -v /man/

What this will do is to report all files that have world-writable permissions (excluding the man pages which are OK). If you see any familar commands (datafiles are not as important), you need to change the root password immediately and start looking at overall system security, perhaps with the help of an expert.

Re: login problem

Jeroen Peereboom — Tue, 10 Feb 2004 02:46:54 GMT

Bill,

you are right. Either someone screwed up the system by accident, or the system has been hacked...

JP.