Edit the passwd file

[SURI HUNJAN]

Hi All,

This is an admin related question.
HPUX - 11.0. Standard Security ( Not a trusted system ). We were able to edit the passwd file and replace the encrypted password in the file with an *. This basically secured the user from logging in e.g telnet, but we could su from root or an remsh from another host ( having set the .rhosts )
But since we have installed the XSWHWCR1100 ( sept 2001) and QPK1100 (Dec 2001), we can no longer remsh - we get an error remshd:account disabled! To make it work again, we have to replace * by * i.e. a single character + *.
Has anyone come across this. Could a patch have resulted in this. Had a look at the passwd and r-command patches but nothing related to this is mentioned.

[Pete Randall]

It sounds like a flaw that got fixed by a patch - I don't think you ever should have been able to remsh using a disabled account.


Pete

[Steven E. Protter]

That action invalidates user logon completely, telnet, remshd, ssh.

You should use vipw instead of vi, it insures exclusive access to the passwd file.

remsh is a bad idea, I recommend secure shell, and am adding in a link to the free software and Chris Vale's cookbook on setting up secure password free users.

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA



SEP