Passwd asks password 4 times when changing root password

[SvevaT]

Hi there,

I'm new in this forum, I'm not sure I'm posting in the right section.

I am a security application manager and I'm having issues related to passwd command behavior on an HP-UX server. ONLY for root user, when I execute passwd command then I'm asked to type the new password 4 times or, we can also say, it starts the password change loop twice:

> passwd
Old password:
New password:
Re-enter new password:
Sorry.
Changing password for root
New password:
Re-enter new password:
Passwd successfully changed

Is there a way to change this behavior and limit a password change to:

> passwd
Old password:
New password:
Re-enter new password:
Passwd successfully changed

# uname -a
HP-UX XxXxxXxXXxx B.11.23 U ia64 0208165727 unlimited-user license

The server isn't trusted and every line /etc/default/security is commented.

Thanks for helping me,

Best regards,

Sveva

[Bill Hassell]

The dialog seems to indicate that the new password did not match.

Very important for any computer OS: 
Be wary in using special characters in password strings. Several special characters have meanings beyond the character itself. And depending on how you setup special character handling, the character never makes it to the passwd program. Check the man page for the stty command for flexible ways to define characters.

There is no common set of special characters among any operating system that can are dependable for passwords. For HP-UX, here are a few problem characters:    !#$%*{}  and spaces.

Try setting root to an alphanumeric string. If passwd works normally, you can play with your desired string but realize that it may not work on another HP-UX system.

If there are no special characters, then the passwd program may have been replaced. Find out where the passwd program originates when you type the command:

# type passwd
passwd is /usr/bin/passwd

Then verify a reasonable header (depends on OS version and patches)

# what /usr/bin/passwd
/usr/bin/passwd:
$Revision: @(#) passwd R11.31_BL2013_0503_1 PATCH_11.31 PHCO_43235

Someone may have changed your $PATH or hacked the passwd program.

[SvevaT]

Hi Bill,

thanks for your answer.

I've tried several passwords, with or without special characters, and the behavior does not change.
Please note that I paste the password within the shell, so the trouble is not a password mismatch.
The strange is that I can insert a password twice in the first loop, and after "Sorry" I can insert a different password (twice) and the last one is the password accepted.
Here's the output of the commands, it seems quite normal:

server1:/# type passwd
passwd is /usr/bin/passwd
server1:/#
server1:/# what /usr/bin/passwd
/usr/bin/passwd:
$Revision: @(#) passwd R11.23_BL2007_0503_4 PATCH_11.23 PHCO_36426
server1:/# uname -a
HP-UX server1 B.11.23 U ia64 0208165727 unlimited-user license

Any idea?

Thanks for helping,

BR

[Bill Hassell]

The latest patch for passwd is PHCO_39768. The README file does mention the behavior you are seeing but it is about all there is for the passwd program. Note that this latest patch is more than 10 years old. HP-UX 11.23 has been obsolete for several years and is no longer supported by HPE.

[SvevaT]

Hi Bill,

I'm managing two more servers with same patch level that behaves normally (new password asked only twice).  I guess this won't have a solution since OS version is out of support, anyway thanks for your answers.

BR 

Sveva