topic Re: Cannot change password when su'ing in Operating System - HP-UX

Cannot change password when su'ing

Pactiv Development — Mon, 01 May 2006 14:13:32 GMT

I have a user that su's over to some application ID's - let's call it zzzzzzz in this example.

Due to lack of use, zzzzzzz was disabled due to the password expiration interval being exceeded. We used sam to reactivate/enable the account - which also genned a new random password. We passed the new temporary password along to the user.

When they su'ed over to the application ID, they received the following messages in rapid succession:

Your password has expired.
su: Password for zzzzzzz has expired. Choose new password and try again
su: Sorry

They are never given a chance to enter the old (temporary) password.

The only way I could get the user going was to su as root over to zzzzzzz, then enter the passwd command (which allowed me to enter the temporary password and then pick a new one).

But certainly the user needs the ability to su over and enter the temporary password.

Is there something special (or broken) when using su over to these application ID's?

Scott

Re: Cannot change password when su'ing

Steven E. Protter — Mon, 01 May 2006 14:23:38 GMT

Shalom Scott,

I've done the same sequence as you on trusted systems and not yielded the same results.

pwck
grpck

Lets see the intergrity of the databases here.

Also check /var/adm/syslog/syslog.log for messages. Maybe there was a short term problem.

You may wish to try re-enabling the password at the command line (man passwd) and see if you get a specific response.

Seems to me you did everything right.

SEP

Re: Cannot change password when su'ing

DCE — Mon, 01 May 2006 14:37:12 GMT

How are the users connecting? Xterm, vt100 emulation?

Some emulators will send an unwanted, unseen, code when the neter key is pressed.

You could try either a different emulation package, or a different term type.

HTH

Dave

Re: Cannot change password when su'ing

Christian Tremblay — Tue, 02 May 2006 07:29:35 GMT

I don't think it's possible at all to change the password by using su.
You have to login directly into the target account using either telnet, rlogin, ssh or whatever you use, change the password and logout.

You will then be able to su to the account.

Re: Cannot change password when su'ing

RAC_1 — Tue, 02 May 2006 07:34:16 GMT

Any chance that password (old) was more than 8 chars and did not contain special chars-like *, @ etc.

Re: Cannot change password when su'ing

Pactiv Development — Tue, 02 May 2006 10:03:42 GMT

Dave -

We use Hummingbird Exceed Secure Shell 10.0 that sets up a xterm session. I can try this with Putty and see what happens.

Scott

Re: Cannot change password when su'ing

Pactiv Development — Tue, 02 May 2006 10:04:33 GMT

RAC -

No - the old password (generated by the system) was just 8 lower case characters.

Scott

Re: Cannot change password when su'ing

Pactiv Development — Tue, 02 May 2006 10:06:40 GMT

Christian -

Is this a restriction of the OS? We spedifically require users sign in with their personal ID's before they su over to application ID's (so we have an audit trail). If the OS disallows password change when coming in via su, this would be a problem.

Scott

Re: Cannot change password when su'ing

Christian Tremblay — Tue, 02 May 2006 10:56:39 GMT

SOX compliance indeed requires that every user logs in as himself before "su"ing to another account. But in the case of having to change a password you can't use su.

Possible workarounds could be to have the sysadmin reset the password and communicate it to the users or maybe setup a sudoers file that allows running the passwd command by the user with a NOPASSWD entry.

Some sites will just make an exception to the rule and allow users to login directly to a generic account ONCE to change the password.