topic unlock root account without bringing down the system in Operating System - HP-UX

unlock root account without bringing down the system

hpuxhelp — Thu, 26 Dec 2002 21:09:59 GMT

Is there a way to do this ?

Re: unlock root account without bringing down the system

Patrick Wallek — Thu, 26 Dec 2002 21:14:42 GMT

The 2 ways I can think of:

1) You have an id that has root-like access (via restricted SAM or sudo) and can run the appropriate commands to unlock root.

2) You already have root logged in somewhere else.

If the above 2 fail, the only other thing I can think of is to reboot the system and go into single-user mode and modify /tcb/files/auth/r/root and modify the line u_pwd so that it looks like:

u_pwd=:

This is why I am a firm believer in modifying roots default security settings so that you are allowed something like 99 invalid password tries before the account gets locked.

Re: unlock root account without bringing down the system

Patrick Wallek — Thu, 26 Dec 2002 21:16:26 GMT

Oops.....I hit submit and realized you just needed to reactivate the account, not clear out the passwd. Once in single user mode, you should then be able to do the modprpw command to reactivate root.

Apparently I'm still in Christmas Holiday mode.

Re: unlock root account without bringing down the system

Jeff Schussele — Thu, 26 Dec 2002 21:27:27 GMT

Hi Patrick....

Don't think this user is running the system Trusted.
See their earlier post:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x60d27680e012d71190050090279cd0f9,00.html

What they need to do is run
passwd -d root
Unfortunately they HAVE to be root or root-equiv to do so.

Dido - If you don't have another root-level user, the ability to rlogin from another system OR another root session available somewhere, you'll have to reboot to single user mode to reset the root account. This is of course deliberate - you don't want to make it easy - at all - for an avg user to mess with the root account. For obvious reasons....

Good Luck,
Jeff

Re: unlock root account without bringing down the system

hpuxhelp — Thu, 26 Dec 2002 21:30:53 GMT

hi,
so what you suggest that we do not have to edit the /tcp file once we able to boot to single user and just run
modprpw -l root ?
and this will activate the root account ?

Re: unlock root account without bringing down the system

Sridhar Bhaskarla — Thu, 26 Dec 2002 21:36:05 GMT

Hi Dido,

If you are using trusted system,
Did you try login from the console?.
You should be able to get in. Once you login use /usr/lbin/modprpw -k root to enable the account.

If you don't have trusted, you will need to get in into single user mode.

-Sri

Re: unlock root account without bringing down the system

Jeff Schussele — Thu, 26 Dec 2002 21:37:01 GMT

OK - so you ARE running the system in Trusted mode?
If so proper command would be:

modprpw -k root

If NOT trusted - use:

passwd -d root

You can easily tell the diffference. If trusted there will be the /tcb/files/auth directory structure in place. If not Trusted it won't be there.

Rgds,
Jeff

Re: unlock root account without bringing down the system

Patrick Wallek — Thu, 26 Dec 2002 21:44:37 GMT

If you KNOW what the root passwd is, then yes, just run the 'modprpw' command to reactivate it.

If you do NOT know the root passwd, then you need to reactivate root and also change the passwd to something you know, whic MAY require you to modify the /tcb/files/auth/r/root file since the passwd command asks for the old passwd when you change a passwd.

Re: unlock root account without bringing down the system

Sridhar Bhaskarla — Thu, 26 Dec 2002 21:44:57 GMT

hmm.. I am confused. Just in case if anyone looks at this thread in future.

Did you say your 'root' account is locked or you lost the password?.

If you lost the password then above suggestions may apply.

If the account is locked and if you knew the password, login from the console will allow to gain root session and then you can run modprpw -k root to enable the account.

-Sri

Re: unlock root account without bringing down the system

hpuxhelp — Thu, 26 Dec 2002 21:47:36 GMT

hello,
Can't log into the console because of this message "nfs server is still responding"...
therefore we can't get into root...that is where the problem begins

Re: unlock root account without bringing down the system

hpuxhelp — Thu, 26 Dec 2002 21:56:54 GMT

the root account was locked...

Re: unlock root account without bringing down the system

avsrini — Fri, 27 Dec 2002 05:25:25 GMT

Hi,
Is it nfs server still "not" responding or
nfs server still responding?.

hit Cntl+C or break key of your console. you should get
the login prompt.

Is your server is booting or
running for sometimes when you
got this error?.

By-the-way what nfs configuration's do you use?.

Can you be little brief?.

Srini.

Re: unlock root account without bringing down the system

hpuxhelp — Fri, 27 Dec 2002 17:33:56 GMT

Edit the /etc/rc.config.d/nfsconf
all the nfs_client, server and
everythings to =0
and also stop the rpc binding
nfs.core. Still didn't have an effect...
When issue a bdf...this is where the notification occurs :
nfs server hosta not responding still trying...

** no nfs mount points in the /etc/fstab...
any suggestions??

Re: unlock root account without bringing down the system

Martin Johnson — Fri, 27 Dec 2002 17:44:55 GMT

Remember to use /sbin/init.d/[nfs.core|nfs.server|mfs.client] stop to stop nfs. You may have to do a "ps -ef | grep nfs" to see if any nfs processes are still running. Use a "kill -15" to stop the processes. You may need to do a "kill -9" to actually get rid of the processes.

It sounds like someone did an NFS mount and the mountpoint is stale.

HTH
Marty

Re: unlock root account without bringing down the system

John Meissner — Tue, 31 Dec 2002 12:21:54 GMT

I've unlocked the root account once with another UID 0 (zero) account. One of the applications that we run on a server requires UID 0 (against our better judgement) but It saved us a reboot once.