Cannot Boot System in Single-User Mode

[Andre Lemon]

Hello everyone, here is my problem.

I came in this morning and when I tried to log
onto the system I got a message saying invalid password. (I got this message for every login
that I tried). Something must have happened lastnight to the passwd file. So I am trying
to reboot to single-user mode (for the first time I might add).
I powered off the system,
Then interupted the process
At the boot menu I typed "bo pri"
At the ISL> prompt, typed hpux -is
The system then does it thing and then prompted
me for a login name, when I typed root and also a pseudo root called "alsoroot" neither
of the passwords worked, I got a message stating that "authentication incorrect"
so I am stuck at that.

Can anyone help me get logged in so that I can
check reset the root password as well as check the passwd file to see if it exhists.

Thanks,

Andre'
please enter a login name prompt

[Mel Burslan · Accepted solution]

may I suggest putting in a support CD and booting to a recovery shell to see if you can see the passwd file. And I am not sure why you are getting asked for authentication in the single user mode, unles you specifically set this option on the system security settings or there is a possibility of someone with root privileges doing it for you overnight.

[Pete Randall]

Andre,

It seems there must have been a problem in your procedure although it sounds correct. If the system truly came up in single user mode, you would already be logged in as root without any prompting for a login name or passwd. When you say the "system then does it thing", exactly what are you seeing? Do you see the menu list with start/wait alternating, or do you just see some text containing all the copyright information and so on?


Pete

[Andre Lemon]

I would have to find the CD that you mentioned, I inherited this system as well as the Sys Admin role. I do not have any idea how the security was setup, this system was configured 9 years ago. No one works at night anymore since my company is going out of business in a few months, we are in close down mode. I do not have anymore Operators
on staff.

Am I doing the correct thing to get into single user mode?

[dongming]

i also think you made some wrong step to boot to single user mode.
any way, if it doesn't work, you can boot to maintainance mode.
ISL>hpux -lm

and then mount all os fs, and change passwd.

[Andre Lemon]

Good question Pete, at this point I can't remember, I 'interupted' at the point where
is said press any key within 10 seconds, I will do that again since I cannot scroll back the console screen.

[Andre Lemon]

dongming, I got the same login prompt when
I did the hpux -lm when that did not work
is when I started over and typed hpux -is

[DCE]

It sounds like the system has some additional security installed - either trusted mode or /etc/default/security has been configured to verify all root logins - the recovery shell on the CD will get around this issue.

[berenger aguissi]

Hi Andre,


An option I may like you to try is to connect a windows machine to your unix box console port using an appropriate serial cable (R232c). Try now to access your unix box througt HYPERTERMINAL with your windows machine com1 or com2 port.

Another option is to use the secure web console to access your unix box trough the internet explorer.


Regards.
Berenger.

[Andre Lemon]

Ok, here is some more messages, I rebooted
and missed the 10 second window to interupt,
so when the system rebooted on its own, the
following messages resulted:

sbin/ioinitrc:
/dev/vg00/lvol1: 1 BLK(S) missing
/dev/vg00/lvol1: Bad cylinder groups(fixed)
/dev/vg00/lvol1: 46 files, 0 icont, 41927 used, 41806free (96 frags, 5124 blocks)

inst: Failed to find user bin in passwd file, using uid2 instead.
inst: Failed to find user root in passwd file; using current uid (0) instead.

please enter login name:



I am going to go reboot again and try the single user interupt again.

[generic_1]

Reboot the machine
when the ten second interrupt boot screen comes up press a key
then do a
boot pri
say yes to interact with IPL
then do
hpux -lm
mount any filesystems you need such as var usr and so on
passwd root
change your root password


If you are still locked out because of a security program.

Depending on the type of backup system you use. If it has a client on the machine. You may be able to boot up the machine and restore /etc/passwd to the machine from your backupserver and /tcb if you run trusted machines.

Once you get back into your machine. Change all the passwords and make sure no one stuck a root shell somewhere on the box. It sounds like someone fooled with your system and this is not good.

Also if you have ssh with keys, sudo, powerbroker, and su setup You may be able to think of creative ways to gain access back to your system. For example you had ssh keys setup to allow you to ssh to the box, and sudo setup to allow you to sudo to root. Not a default way, but knowing your evironment be creative too. :)

Good luck

[Pete Randall]

I think this is your issue:

"inst: Failed to find user root in passwd file; using current uid (0) instead."

There is no "root" user in the passwd file so it can't automatically log you in as root and prompts you for a login name. I think you're going to need to find that CD. It looks to me like someone prior to you trashed the passwd file and who knows what else!!


Pete

[Andre Lemon]

the hpux -is is not working, I got those
same messages as my last reply, and after the "failed to find" line it also had

overifing default level with level 's'

Boot Authentication:

Please enter your login name:


So I will now try the hpux -lm again and
hope for the best.

[Andre Lemon]

Pete, this would have had to be done by someone remotely, we are down to only 6 people in I.T. now and I am the only one with root access... a few months ago the
'root' password expired and my Sr. Op changed it, then forgot what he changed it
too, this was discovered when I tried to log
on as root one day and the password had expired a second time and he mentioned that he changed it a while back, then of course in order to change it you need to no the old
password and he could not remember it. So as
a work around I have been using a backup root
logon "alsoroot", does this give you any additional ideas why this single user mode is not working?, when I enter alsoroot or
a few other operations user-ids they do not work either, can you mount devices from the ISL prompt?

[Mel Burslan]

Dire situations need dire remedies. This is kind of a big hack but it may work if you have the right stuff.

First off, Do you have a same model and very very similar configuration machine in your data center ? If not, my plan is dead before it could event start. But if you do, and by sheer luck, you have a hot pluggable (user servicable) root disk and can afford some down time on thas server, you can shut it down, replace that disk with your semi-dead root disk. Boot your server, and hopefully you have another slot for the dead disk that you can connect it to. Copy a known good passwd file over from the currently running disk. Put back the drive into the root drive position and try booting it this way.

I know this is a lot of things to expect but you never know. You may luck out.

Good luck

[Patrick Wallek]

Judging from the messages, it really does sound as if your /etc/passwd file is totally trashed and possibly not there at all.

I agree that the recovery CD sounds like a good option. Other than that, maybe restore from a recent Ignite tape?

[Andre Lemon]

Well gentleman, it seems that I am dead in the water. We do not have another HP9000, we
sold that a few months ago, I do not have
that CD either, so I will have to contact HP and have them ship me a replacement. I tired
the hpux -lm and got a big list of messages

I just went out to write the messages down and the system tried to reboot itself and
not the red fault light is blinking so that
is not a good sign... lol

Users were supposed to have weened themselves
from this system anyway and were just using it to look up some old information....

I will assign points prior to closing this thread once I get the matter resloved (when I get that CD from HP)

Thanks for all your time and efforts as always.

Andre'

[Andre Lemon]

Good Morning to you all, I received the recovery cd from HP this morning. I tried to boot from it, did a "bo p4" and then from the ISL> prompt typed hpux -is and got a message stating "exec failed cannot find /stand/vmunix or /vmunix


Any suggestions?

[Mel Burslan]

Andre,

assuming p4 is the selection number for your optical media reader like cd or dvd drive upon making a search at the boot menu, I suggest you let it do its boot up without any interruptions after making the "bo p4" selection, i.e., do not opt to interact with isl at all. The kernel on this CD is not vmunix as far as I know. Just let it take you to a rdumentary menu system, which is same or very similar to the character based system install menu.

[Andre Lemon]

I worked with HP and got the issue resolved.
I was able to boot from the recovery CD and working with them on the phone for 1.45 hours
everything is fine now.

I thank you all for your time and efforts.

Andre'