an ordinary user failed to telnet but able to be "su"

[Shan_2]

An unix account which could telnet to the host (hp-ux 11i) 4 days ago. However, this unix account was found unable to telnet to the host this morning. "lastb" showed this user failed login attempt. But, another unix account could "su" to this unix account with the same password for "telnet".

Which files/settings I should check ?

Thanks,
Shan

[Mobeen_1]

Shan,
Try the following files

/etc/passwd
/etc/hosts.allow
/etc/security
/etc/shells

Let me know if you need any additional information.

rgds
Mobeen

[Karthik S S]

I think the account is locked. Check if the /etc/passwd has a "*" in the password field for the user. If yes remove the "*" and reset the password

-Karthik S S

[Shan_2]

Thanks Mobeen and Karthik.

The /etc/passwd is normal and no "*" in password field, i.e., this user is not locked. And, this user is not expired as I have re-assigned the password to this account.

This account's shell also defined in /etc/shells.

And, we haven't defined /etc/hosts.allow & /etc/security.

Besides, I have just tried to use "ftp" to login this user, it is OK.

This unix account belongs to two groups. Could it be related to multiple groups ?

Thanks again to all!
Shan

[Patrick Wallek]

What error do you get when the user attempts to log in via telnet?

[Mobeen_1]

Shan,
In that case as our friend Patrick has requested, posting the exact message that you see when one tries to telnet will help.

Since you mentioned about 2 groups, can you confirm whether you are having problems with only users from one group telnetting into this box or is it that all the users are unable to telnet into this box.

rgds
Mobeen

[Shan_2]

Thanks again Patrick & Mobeen.

The error was just "Login incorrect".


This unix account belongs to two groups. Other unix accounts of these two groups are able to telnet to this host. It seems that only this particular unix account unable to login via telnet. This account cannot login from console too (same "Login incorrect")!

[Shan_2]

Dear all,

The problem identified. It was due to the special "password" character of this unix account.

This unix account enabled password aging. There is also a special character @ in the password.

BTW, this problem seems to be occurred just today (March 22).

Thanks all!
Shan

[Trond Haugen]

So this user has problems from the network (telnet) and on the console. This rules out networking security problems.
Further the user gets to enter login name and password and then gets "Login incorrect". But su to that user works. Belongine to more than one group is no problem.
Is that 'su user' or su - user'?
Have you tried changing the password of that user?
Does remsh work for that user?

Regards,
Trond

[Zeev Schultz]

Couldn't it be "not a usual telnet" but
a link to something like "ssh"? (check with
'grep telnet /etc/inetd.conf" and ll /usr/lbin/telnetd).

Could it also be a specific host that telnet from there is locked? (check /var/adm/inetd.sec).Have you tried telnet'ing from somewhere else with that user.

I would also check with running "tusc -vfp " on telnetd pid if nothing else clears the issue.Like, you launch the telnetd manually (not waitin for inetd to start) and run tusc (get it from hpux.cs.utah.edu).

rgds

Zeev

[Shan_2]

Thanks Trond & Zeev.

The /var/adm/inetd.sec did not deny such telnet. This account failed to login from several PCs.

The problem was due to the password of that unix account.

After changed the password to something without the special character (the at-sign @), the user is now able to telnet the host.

Thanks for all helping me!
Shan

[Ian Box · Accepted solution]

That's because '@' is the delete line character during login, just as '#' deletes the last character typed. This doesn't affect su because that runs under the shell and uses the erase and kill characters set by 'stty'.

[Bill Hassell]

This is a very common problem. The default settings prior to login for serial and telnet connections is ERASE=# and KILL=@. These settings are based on the values used more than 3 decades ago when terminals were real tty's (Teletype hardcopy machines). While it is not recommended to include special characters (compatibility issues between opsystems), you can set new defaults for all tty connections using:

/sbin/stty erase "^H" kill "^U" intr "^C" eof "^D" -parity ixoff < /dev/ttyconf

This works on reasonably patched versions of 11.xx and higher and will make the backspace character work normally during login. The console will not see this change until the next reboot.