console ask for root pw change after converted to Trusted System

[Victor_5]

I used SAM converted my 11.0 from non-trust to trust, I only turned on auditing and did nothing about others, after that, the console asked for root password change if I login from console for the first time, it was fine through telnet, why?

I thought for this kind of conversion, it is no need to change root pw. Correct?

[MANOJ SRIVASTAVA]

Hi Victor


The passwd lifetime is determined by the password againg policy or the security aging policy , you will need to change is as there must be some time limit specified for agiang.


Manoj Srivastava

[Victor_5]

Hi Monoj:

As I said, I did not touch that area, left them default:

Time Between Password Changes: 20
Password Expiration Time: 100
Password Expiration Warning Time: 20
Password Lifetime: 150

Any other idea?

[S.K. Chan]

I'm guesing "console" needs to be reset/respawn .. though this is a bit unusual ..
Kill the "getty console" process and let "inittab" respawn it. Try the root login again. BTW how many characters are in your root password ?

[Helen French]

Hi Victor:

If the root password is set more that 8 characters, then the console may ask you to change it, after converting to trusted system.

Also make sure that you have installed all patches.

HTH,
Shiju

[MANOJ SRIVASTAVA]

Hi Victor

My root passwd was set to 8 chracters but still I got this error , I suggest you unconvert to UNTRUST by suing tsconvert -r and them change the againg policy and then convert to trusted again.

Manoj Srivastava

[Victor_5]

S.K. Chan:

My previous password was 6 characters, the new one is 7 characters, so it should be ok, right?

Manoj:

After I convert back, where can I change the policy?

Thanks all!

[S.K. Chan]

Victor, your # password chars are ok. Can I re-cap my understanding again here .. you're saying after you convert to trusted, then you changed the root password and the changed was succesful. Now only when you try to go in at console directly as root it ask for the password change again, am I right?

[Victor_5]

No!

I did everything from my pc through telnet, after I converted to trusted system, I did not change root password from my pc, but when I went to the console and login, the console asked me to change password, it is only once, after I changed it successfully, the system did not ask to change again.

But I am wondering why because it was unexpected.

[S.K. Chan · Accepted solution]

I usually change my root passowrd first (8 or less chars) then I'll convert to trusted it never prompt for any root password change after conversion. In your case even though unexpected behavior, maybe it's just normal if the password ages to a certain time limit.

[Victor_5]

Changing root password first is a good idea, your explanation is more acceptable, thanks, S.K. Chan!

[Jeffrey Davis_1]

Hi Victor,
As others have mentioned, when changing your system from a non-trusted one to a trusted system, if you have passwords greater then 8 characters the conversion process will truncate all passwords to 8 characters.
Likewise, part of the conversion process is to automatically age all passwords on the system once the system becomes trusted. This is to ensure a clean passwd database.
I have done this on all of my 11.00 systems, but don't remember if I read about this or had to experience it. I think I had to experience it!