unable to login as root ( Account is disabled - see Account Administrator)

[Jerry_109]

HP-UX fdhp31 B.11.23 U 9000/800/A500-7X
########################

$ cat /etc/passwd | grep root
root:*:0:3:root on fdhp31:/root:/sbin/sh

$ su -
Password:
Account is disabled - see Account Administrator

$ cat /etc/securetty
/dev/console

[Robert-Jan Goossens · Accepted solution]

Hi Jerry,

You should be able to logon from the console, use "/usr/lbin/modprpw -k root" to unlock the root account.

Regards,
Robert-Jan

[Tim Nelson]

As mentioned.

You have two constraints.

1) direct login of root via telnet is restricted to the system console via the /etc/securetty file

2) account is disabled but the disable is overridden if login is from /dev/console.

modprpw -k root will remove the lock.

I personnally do not set an expire time on my root account, I diligently change it every 30 days. ( this assumes it became disabled due to expiration, not for some other reason like too many attempts ).

[Jerry_109]

unable to access root via console. I can access with userid j4s9389, but cannot su - :

# telnet fdhp31c
Trying...
Connected to fdhp31c.scif.com.
Escape character is '^]'.
Local flow control off

Service Processor login: root
Service Processor password:




Hewlett-Packard Guardian Service Processor

(c) Copyright Hewlett-Packard Company 1999-2002. All Rights Reserved.

System Name: fdhp31c



[Read only - use ^Ecf for console write access.]

[bumped user - ]


GenericSysName [HP Release B.11.23] (see /etc/issue)
Console Login: root
Password:
Login incorrect

Wait for login retry: ..
login: j4s9389
RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the U.S. Government is subject to
restrictions as set forth in sub-paragraph (c)(1)(ii) of the Rights in
Technical Data and Computer Software clause in DFARS 252.227-7013.


Hewlett-Packard Company
3000 Hanover Street
Palo Alto, CA 94304 U.S.A.

Rights for non-DOD U.S. Government Departments and Agencies are as set
$ su -
Password:
Account is disabled - see Account Administrator
su: Sorry
$

[Tim Nelson]

This looks to me that after connecting to the console you have the wrong password for "root"

GenericSysName [HP Release B.11.23] (see /etc/issue)
Console Login: root
Password:
Login incorrect


After you log in as another user and try to su you are being denied because the password for root is disabled.

[Jerry_109]

Yes, I think you are correct. Now how do I correct the problem ?

[OldSchool]

you're probably going to have to boot into single user mode...once there you should be able to access the root account

site search is having problems, but you should find some help via google. search

root locked site:itrc.hp.com

[Dennis Handly]

>unable to access root via console.

You're accessing the machine through the GSP, not the console. I assume they are different.

[Tim Nelson]

If you do not have access to the root password then one of two things.

1) if you have delgated shutdown privelages (someplaces do this for their operations staff ) then reboot the system nicely to single user mode and reset root's password.

2) if no abitlity to shutdown nicely then you will have to crash the server via the MP TOC or reset options (or power on/off ), then interupt the boot process and boot to single user and fix the password. Shutting down any and all applications first will reduce the risk of data loss.

[Norman_21]

The /dev/console means that you won't be able to telnet as root but it's funny this file doesn't apply to SSH so if you have SSH you should be able to login as root assuming the account is not disabled.

About the locked account. Is this a trusted system?
You should create additional rootxx as a duplicate root account level for backup or setup sudo to save you from such situations in the future.

You don't have many options my friend. Since this an A-Class 500 System, just go to the Console and hit CTRL+B and then from the GSP prompt type "rs" and say "y".

Interrupt the system during the boot process, then boot your system into single user mode, mount the file systems and edit the password file or if this is trusted system edit the /tcb/files/auth/r/root file to remove the lock. You could also run the commands instead of editing the files manually.

Hope this help