topic Re: Regarding a users password change. in Operating System - HP-UX

Regarding a users password change.

raiden — Thu, 16 Oct 2008 04:29:04 GMT

Hello ,

I am facing a strange problem . A user "ABC" claims that when he logged in today morning he got a message that his password has been changed by user "XYZ". But when i checked the sudo permission of user "XYZ", he doesnt have any sudo rights. He just has sudo to an application ID. Please can you help me to explore what could be the possibilities or problem.

Regards,
Amogh

Re: Regarding a users password change.

OFC_EDM — Thu, 16 Oct 2008 05:39:41 GMT

Check the UID of each user. They should be different. If they're the same then they're actually the same user and could change each others password I believe....although I haven't tested that.

Which OS are you on?

Re: Regarding a users password change.

raiden — Thu, 16 Oct 2008 06:04:56 GMT

Hi Kevin,

I am on HP-UX 11.23. I have checked the UID . Both are different. So its getting even more confusion.

Regards,
Amogh.

Re: Regarding a users password change.

Rohini Deshpande — Thu, 16 Oct 2008 06:46:28 GMT

Hi Kevin,

Does that application in any case have a facility to change password?

On HP-UX, users can get sudo permissions in the following ways
1) Using RBAC (Role based access control). In this case XYZ should have the privilege to run "passwd" command.
2) sam -r (Restricted sam) - In this case user XYZ should have permission for "ugweb or Accounts for user & groups" area of SAM from where he can change password.
3) SMH - System management homepage
Administrator privileges for XYZ can give him permission to change password using ugweb/Accounts for Users & groups tool from SMH.

Regards,
Rohini

Re: Regarding a users password change.

Rohini Deshpande — Thu, 16 Oct 2008 07:06:46 GMT

In the above mail I meant the ways to get sudo like privileges & not exactly sudo permission.

Re: Regarding a users password change.

Dennis Handly — Fri, 17 Oct 2008 00:37:39 GMT

Do you have the exact message?
I don't think I have ever seen a message like that. And why would a message be sent?
I.e. if the password was changed, how could you login?

There also is a similar thread today:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1278859