Can't log in on a trusted system

[Yvonne Butler]

I have a recently trusted system that's locked out my user accounts (except one with hardly any permissions/access whatsoever). I've booted into single-user mode but can't run passwd -f root. Basically the password has expired and the account was disabled in multi-user mode. Even going to the console wouldn't allow me to log in as root to change the password. How can I change the root password therefore in single-user mode when "passwd -f root" doesn't work?

[Sridhar Bhaskarla · Accepted solution]

Hi,

You would need to unlock the root's account.

#mount /usr
#/usr/lbin/modprpw -k root

Your /sbin/passwd -f should work.

If not, then edit /tcb/files/auth/r/root and nullify the strings next to u_pwd=. Then try changing the password.

-Sri

[Steve Steel]

Hi

Try

/usr/lbin/modprpw -k root


Steve Steel

[David_246]

Hi Yvonne,

You can boot of the CD and and mount the root-FS of the disk in.
Then empty the root-pw or paste your known pwd in in the /tcb/files/auth/r/root file

When rebooting you will be able to login again.

Regs David

[RAC_1]

Goto single user mode. and unlock root and change password. Then you can unlock all accounts.

When you convert to trusted mode all accounts will be expired. You can avoid that using following command.
/usr/lbin/modprpw -V

You can unlock all accounts with following command.

/usr/lbin/modprpw -k "account_name"

[Sridhar Bhaskarla]

Hi,

I don't know if I correctly understood your message. Did you mean you were not able to get into single user mode?.

This happens when enabled "Require Login upon Boot to Single User mode" while converting the system to trusted.

In this case either you have to boot the system through CD and manipulate the tcb files or move the disk to another system, import it and mount the root filesystem (not recommended).

-Sri

[Jeff Schussele]

Hi Yvonne,

Sri has the proper answer.
When you boot single-user, nothing's mounted except / & /stand - so you either have to run /sbin/passwd or mount /usr.
And if the account is disabled then
/usr/lbin/modprpw -k root
will reenable it - but again, you'd have to mount /usr.

Rgds,
Jeff

[Steven E. Protter]

It s possible that the great solutions above will not work.

In that case you need to null out the passwords, at least for root.

Here is how:

In single user mode

cd /tcb/files/auth/r

vi root

There is a line named u_pwd

remove everything between the equal sign and : (colon)

Save the file.

Root now has no password.

Boot the box and set a password.

SEP

[Vijaya Kumar_3]

In trusted system, it is nice to install and configure sudo package.

Add some other admin users as sudoers to have root privileges access to modprpw command. So, when an account gets disabled including root, you can use these sudo accounts to enable them.

[Yvonne Butler]

The single user methods aren't working. When mounting /usr its showing nothing in the directory (could be a corruption on the disk). I'm about to try booting from the CD therefore.

[Sridhar Bhaskarla]

Hi,

No point booting from the CD if you think that the filesystem is corrupted. I wonder if /usr is really getting mounted. Try this while you are in single user mode.

#grep usr /etc/fstab
Note the corresponding device file say /dev/vg00/lvol5
#mount /dev/vg00/lvol5 /usr

If it says corrupted, then you would need to do fsck. If fsck didn't fix it, then it is really corrupted.

As I said before and mentioned by others, you can manually remove the root's password by editing /tcb/files/auth/r/root file.

-Sri

[Yvonne Butler]

Ahhhh, an fsck on /dev/vg00/lvol8 fixed the problem with /usr. I then could run "/usr/lbin/modprpw -k root", and "passwd -f root" but I still can't log in as root in multi-user mode. Whatever password I put in is wrong. I'm now booting into single-user mode again. Any ideas anyone?

[Yvonne Butler]

By the way, I tried to edit the /tcb file but vi isn't available so I can't edit it.

[Yvonne Butler]

Its fixed now, thanks everyone. Initially I couldn't vi the /tcb file because the /var directory wasn't mounted, once that was mounted I could vi the file but the terminal type wasn't set. Once that was set I edited the /tcb file and blanked out the password for root. Booted into multi user mode and its let me log in as root and I've now set a password. Thanks very much everyone.

[RAC_1]

Is your password more than 8 chars? If yes try logging in with first 8 chars of the password only.

Also are you using any special chars in password? Specially such as @. then exclude that, create new password and try.