Enable the user

[Abhilash Krishnan]

I am facing a problem for enabling a user even after using the /usr/lbin/modprpw -k username command it still shows acclockout=0001000. this is a crtical user.pls reply.....

thanks

[Anshumali · Accepted solution]

Biju,

Here is my experience which i had once, not sure how much it is related with your issue.

The user was getting disabled at soon as i enable and the 1 was at 4(incorrect password), to watch it carefully, i had to increase the login attempts to 99 for testing and saw that there was a script which was doing that login attempts at fast pace. We found that password was changed but no one bothered to change the password in the script and account was getting disabled. You may get the messages for wrong login attempts in syslog.
Other things to check:
1. lastb -R|grep -i user
2. syslog for failed logins

Anshu

[Anshumali]

Or may be this account is being compromised by some malicious attempts. In this case, lastb -R |grep -i user might help.
Think from Security Perspective :)

[Steven E. Protter]

Shalom,

definitely a potential security problem.

Could also be an errant scripted login from an external or even internal script.

There will be entries to help you track this down. See /var/adm/syslog/syslog.log to start out.

SEP

[Abhilash Krishnan]

Problem not yet solved i am attaching the output of /usr/lbin/getprpw user pls check...

[Jeeshan]

did you try to enable the user with SAM?

check with SAM and also check the syslog.log file.

is it in trusted mode?

[Abhilash Krishnan]

yes..i tried with sam also...its a trusted system.

[Anshumali]

Did you check your syslog.log
The imp thing i see in your getprpw is below, see the timestamps.

slogint=Thu Jul 3 18:37:45 2008
spwchg=Thu Jul 3 18:37:57 2008
ulogint=Thu Jul 3 18:38:27 2008 ----->(Does syslog capture this failed attempt just after successful login/passwd change)