topic Re: reactivation of disabled accounts in Operating System - HP-UX

reactivation of disabled accounts

yurika — Thu, 26 May 2005 13:44:34 GMT

I got a bit overzealous trying to clean up user accounts on our HPUX 11i systems. I turned on global password aging expiration using SAM. after doing so, I went back to reactivate some accounts for some users.....even some of the system accounts.

Now I am trying to disable those accounts that are supposed to be disabled, such as sys, adm, daemon, lp...etc. I have a system which I haven't done this to, and I would like to copy their /tcb/files/auth/[daemon] file over to restore the default. is this a wise move? or is there a better way to restore.

the default i believe is supposed to have no password, an * indicating that the account is disabled.

Thank you in advance.
Yurika

Re: reactivation of disabled accounts

Doug O'Leary — Thu, 26 May 2005 14:27:36 GMT

Hey;

for user in sys adm daemon lp
do
echo ${user}
passwd -l ${user}
modprpw -e ${user}
done

HTH;

Doug

Re: reactivation of disabled accounts

yurika — Thu, 26 May 2005 14:37:58 GMT

modprpw is not found when I try to excute it.
my system IS in trusted mode, what else could be preventing me from finding the command?

Thank you,

Re: reactivation of disabled accounts

Rick Garland — Thu, 26 May 2005 14:39:59 GMT

If you have trusted system, all passwds are * in the /etc/passwd file.

This does not indicate that the account is disabled.

Re: reactivation of disabled accounts

erics_1 — Thu, 26 May 2005 14:42:28 GMT

/usr/lbin/modprpw

Re: reactivation of disabled accounts

Kent Ostby — Thu, 26 May 2005 14:47:43 GMT

yudi ... check out this document . It has some good tips for troubleshooting this type of issue: KBRC00010639

Re: reactivation of disabled accounts

Denver Osborn — Thu, 26 May 2005 14:52:26 GMT

For those system accounts (daemon, bin, adm...) you could also move aside the users protected passwd file and running pwconv will recreate it. the prpw entry will now be set to an "*", pretty much where they were before you made the global change.

ex:
mv /tcb/auth/files/d/daemon /tmp
pwconv

hope this helps,
-denver

Re: reactivation of disabled accounts

yurika — Thu, 26 May 2005 15:00:04 GMT

Thank you all for all your help!
the update secure password facility, pwconv seems to do the trick!
Yurika

Re: reactivation of disabled accounts

yurika — Thu, 26 May 2005 15:01:21 GMT

thank you!