Can't su to root when password is expired!

[Michel Dijkhuizen]

Hello there,

I have a hp9000 server running trusted hp-ux 11.00. I set expiration to the root password and I restricted root to login only from the console (etc/securetty). So, I only can use root doing a su to root from another user. When the root's password is expired and I want to change it I can??t su to root. It replies with "Sorry" when I type the password. Only logging in with root from the console works and i'm able to change the password. The problem is that the servers console is at another location from the support centre. So i nice long ride .....!!!!

Does anyone knows this problem and has the right solution. I want to keep the trusted options as they are!

Best regards,
Mies

[harry d brown jr]

That's just the way it is.

The solution is a WEB Console:

http://www.raritan.com/public/catalog/product.aspx?pid=43

The product was made by Arula (once part of HP) and now owned by Raritan.

live free or die
harry

[Ricardo Bassoi]

Hi
Try editing the /etc/passwd file. Remove the password field. You can log in to the user login without password. You can assign new password.

Regards,


Ricardo

[harry d brown jr]

Ricardo,

Not if the user is "root" and the /etc/passwd file is correctly permission'ed.

live free or die
harry

[Ravi_8]

Hi Mies

using web console you can achive this

[Juan Manuel López]

on a trusted system the root password is not on password file.
It is on /tcb/files/auth/r/root
Edit this file and delete all the caracters between ':' sign.
Try to loggon again.
I hope this help you.

Do not forget to give us points.

Thanks

Juanma.

[Martin Johnson]

This is one of the reasons we set up a pseudo root account (username, password, UID=0). With the pseudo root account we can reset the root password.


HTH
Marty

[David_246]

Hi Mies,

Did you ever try to do "/sbin/passwd root" from your own acount?
Normaly you have to type root's password now and change it. Never tried it, but can't see why it wouldn't work. Or if you set it to disable you have a feature (within SAM) that does not disable your acount per immediatly when expiring.

And yes of course, if you have a remote location you should work with a terminal server or web-console. What if your system is in trouble ? Will you take the plane then ?

Regs David

[Christian Gebhardt]

Hi
If you are using ssh (urgently recommended) with public/private key authentication you have access to the machine beside the password.


Chris

[Michael Tully]

The simplest solution is to install 'sudo'.

Using

$ sudo su
password:

gives you root access, once the tool is configured properly. There is no need to have an alternative account with uid=0 (dangerous as far as I'm concerned) and you can safely store away 'root' passwords until they need to be changed, without too many people knowing what they are.

You can get 'sudo' from here:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.6/

[Rajeev Shukla]

There are 3 options.
One to buy a webconsole.
Second to install third party software like sudo.
The last, best and cheapest is to write a C program that does a setuid to root but before that checks for your uid and allows only you to switch to root. So that way no one can really switch to root other than u or they crack your password.
Let me know if you any more help in writing that setuid program (also the events can be loged in a file).

Cheers
Rajeev

[Richard Ace_1]

I had a simular problem with expired accounts as well. I found that I could reset the expiry on the accounts "all accounts" by running

(homer) # /usr/lbin/modprpw -V
System is not trusted.
(homer) #

This was run on a Trusted System running HP-UX 11.0 unlike my test server above that I have just demonstraighted on.

Obviously you must consider your Company Policies.

This allowed me to gain access to the expired account.

As I say it worked for me.

I am not sure this is your requirment but should give access by un-expiring the account.

Cheers

Rich

[Michel Dijkhuizen]

Thanx to all responders,

I will test the following options :

Install en test sudo and write a small C program that does setuid 0.

Special thanx to Michael en Rajeev

See yah.