topic Re: Trusted Mode Root Lockout in Operating System - HP-UX

Trusted Mode Root Lockout

Randy Gelineau — Thu, 08 Jul 2004 07:19:24 GMT

Is there a way to force trusted mode to NOT lockout the root account?

We have not identified exactly why the root account is getting locked out but we think it is do to logs filling up.

Re: Trusted Mode Root Lockout

RAC_1 — Thu, 08 Jul 2004 07:27:08 GMT

On trusted system, three unsuccessfuly logins attempts will lock the account. This is controlled by umaxlntr.

/usr/lbin/getprdef -m umaxlntr
/usr/lbin/modprdef -m umaxlntr=5

Now 5 unsuccessfult logins attempts will lock the account

Anil

Re: Trusted Mode Root Lockout

Bharat Katkar — Thu, 08 Jul 2004 07:46:54 GMT

HI,
Have a look at the doc attached.
Hope that helps.
Regards,

Re: Trusted Mode Root Lockout

Randy Gelineau — Thu, 08 Jul 2004 07:59:17 GMT

root will not be able to get into the machine to run any commands if its account is locked.

I would rather not boot into single user mode to unlock it. This is the situation we are trying to avoid.

Re: Trusted Mode Root Lockout

Darren Prior — Thu, 08 Jul 2004 08:25:07 GMT

Hi Randy,

You can change the values for root either as RAC suggested, or via SAM. It's also worth looking at the output of /usr/lbin/getprpw root regularly to see attempted login times and ttys to give you a clue as to what's going on.

Which logs do you suspect are filling up? If your system is configured such that / can fill up with logs then it's possible that this is the cause. However, in this instance I believe that root is only locked out because there's no way of writing logs when you attempt to login, rather than being locked out within the /tcb area.

regards,

Darren.

Re: Trusted Mode Root Lockout

RAC_1 — Thu, 08 Jul 2004 08:33:53 GMT

You can log in through console.

Anil

Re: Trusted Mode Root Lockout

Sridhar Bhaskarla — Thu, 08 Jul 2004 08:38:52 GMT

Hi,

If the root account is locked, it will allow you to login from the console and you can enable the account by running "modprpw -k root".

If you do not want your root account locked, then turn off (make it 99) maximum number of unsuccessful attempts as previously mentioned. If you are planning to do so, then make sure you have /etc/securetty file so that no one will be able to login from other than console. Have a mechanism to notify you after certain number (say 10) of successive unsuccesful attempts so you can keep an eye on malicious attempts.

To find out why root account is getting locked, look at your 'lastb' and the 'unsuccessful su - root' entries in /var/adm/sulog.

-Sri