topic Re: Account locking in Operating System - HP-UX

Account locking

John Ivy — Wed, 13 Aug 2008 11:31:12 GMT

What is the quickest way to findout what computer or user is locking an account.

Re: Account locking

Steven E. Protter — Wed, 13 Aug 2008 12:01:32 GMT

Shalom,

passwd -sa

take a look at /var/adm/syslog/syslog.log

You will see the bad login attempts.

lastb

Also lists bad login attempts.

SEP

Re: Account locking

Doug O'Leary — Wed, 13 Aug 2008 12:02:48 GMT

Hey

Unfortunately, there is no quick way as there's multiple ways of locking an account:

Is the system trusted? If so, run "modprpw -m lockout ${user}". See the man page for the resulting code. Chances are it'll be bad passwords, but it's good to be sure.

Check syslog.log for remsh/ssh accesses. If you're using the software.hp.com version of tcpd, check mail log for accesses via ftp or telnet.

If you're using sudo, check the sudo log for people accessing root and what they were doing.

Some information from at least one of those sources should give you the next step in your investigation.

Doug

Re: Account locking

John Ivy — Wed, 13 Aug 2008 16:08:29 GMT

Thanks for the information I am slowly getting there