changing root password fails on a trusted system .. why ???

[someone_4]

Hello everyone
I am having a well documented problem where on my trusted system the passwd command fails and also though sam. The error is " An invalid command syntax was used to invoke the command "/usr/lbin/modprpw" Failed to update protected password database for user "".

I have read other posts on this issue and have found serveral fixes for this. Everything from take the system down and bring it up in single usermode to just unconvert the trusted system and change the passwd.

What is the best way to fix this without messing with the users on the system and without rebooting the server?

And why does this happened? Is there a patch for this issue?

Thanks
~ Richard

[Christopher Caldwell · Accepted solution]

Try running authck to see what the problem is. Every once in a while, we've seen problems where root's tcb entry got corrupted. The fix is usually is to edit root's tcb entry to blank out/modify the errant part of the root's tcb file.

[Roger Baptiste]

Richard,

Does it work for non-root accounts? If so, edit the file manually :
/tcb/files/auth/r/root and clear the entry corresponding to u_pwd= and try running the passwd command again.

HTH
raj

[Michael Elleby III_1]

Richard, ran into the same problem..

I did it in single user mode, but here's what I did:

1. untrust the system (tsconvert -r)
2. reset the root password
3. then re-trust the system (tsconvert)

The reason why I did it that way, was because another admin had locked out root and I could not get logged in at the console.

Maybe this will help..

Mike Elleby

[Michael Elleby III_1]

Sorry Richard-

I just re-read your post and noted that I missed some pretty important info about not wanting to reboot the server.

Please accept my apologies..

Mike-

[Scott Van Kalken]

Hey Richard

I think that an authck -a should fix this problem.

I've had a similar problem, but I solved it with an authck -a.

[Darren Prior]

Hi Richard,

You haven't told us which version of HP-UX you are using, which would be really useful.

If you are using 10.20 there are a number of patches required for trusted systems (many of which are in HP-UX 11 as standard.)

Anyway, back to your problem! As others have mentioned authck is well worth running - I'd suggest using authck -pv (the -a option also checks the ttys which I don't generally find useful, whereas -pv checks the tcb stuff and lets you know what it's doing.) If that doesn't highlight anything I'd suggest running the following command:

/usr/lbin/getprpw root
Then check to see if there are any 1's in the lockout value. If there are then unlock the root account: /usr/lbin/modprpw -k root
Then try to change the password again. There are some situations which can cause this, including attempting to reset the root password from SAM, or maybe there were too many attempts at the root password.

regards,

Darren.