How to reset root passwrod when no console is available!!

[astra]

Hi,

This is really a weird problem and its really weird to ask.

The thing is we dont have console access or ILO to the server and the server root access is blocked because of multiple attempts of unauthorized login. We have another user which is not blocked but it has limited privilages.

Could anyone suggest how to reactivate the root user?

Thanks in advance!!

Regards,
Amit

[Michael Steele_2 · Accepted solution]

Hi

What is the model of the server?

Start looking at hyperterminal in a laptop and connecting the the box. There is always a serial console connection.

[astra]

Hi Michael,

The thing is server is placed at customer site and some of them on the site has blocked the root access to the server. They also dont have much knowledge about the HP-UX servers. They are not able to access the server through console.

Therefore, we are trying to do it remotely.

The model is RX2660.

Any help will be highly appreciable.

Regards,
Amit

[Michael Steele_2]

Hi

...and no.

http://docs.hp.com/en/AA-XCHWP-32u2/A-XCHWP-32u2.pdf

They will need to find the MP serial connection and MP reset button. I've attached a doc above - seach on hyperterminal and serial.

Here are the basics

Connect the CONSOLE connector to a null modem cable, and connect the null modem
cable to the PC COM1 port on your laptop.

Use a terminal emulator, such as HyperTerminal, to open a terminal window.


Press the Enter key to access the MP. If there is no response, press the MP reset pin on the back of the MP and try again.

[Kapil Jha]

M afraid but i don see any feasible way to do it remotely.

You have to have serial console and change it.

BR,
Kapil+

[Johnson Punniyalingam]

>>
They also dont have much knowledge about the HP-UX servers. They are not able to access the server through console.

Therefore, we are trying to do it remotely.<<

How are you trying to connect remotely?

VPN - to Server with "IP address" ?

You need try some other ways like

Ask the customer do they have any root equalatent User account ?

Can they try "rlogin"

If no Choice, Some one should go ONSITE

Use dump terminal/ Connect laptop via serial cable try to login to server using console

[astra]

Hi All,

Thanks for your valuable time and info.

John: We are using VPN to connect remotely.

I all ask someone to go onsite.

Regards,
Amit

[Torsten.]

You can do this remotely if you have access to the iLO/MP.

[Michael Steele_2]

Hi

You know Torsten is absolutely right and I assumed you weren't configured since you asking. The only catch is it has to be configured before you can telnet or web console into it.

If you refer to the link in my previous posting around page 26 plus and minus

[Bill Hassell]

This is a very common oversight when managing remote systems. You are crippled without access to the real console. You need to configure access before agreeing to manage a remote system. However, the console (actually, a separate processor in modern HP-UX systems) has poor security and should not be placed on the same subnet as normal traffic. If you have a secure serial console concentrator available, then multiple consoles can be accessed with good security. Without console access, any actions requiring a reboot or interaction with the boot ROMs will be impossible.

[Torsten.]

"... has poor security ...".

OK, some require an additional license for ssh. you should get them.

[D. Jackson_1]

Are you backing the server up?
Is the system trusted?

You could always get a copy of the password file, (backup and restore) edit what you need to null the password out (back it up)and (restore) overwrite the password file with the modified one. Same would go for the root entry of a trusted system.
We threw in this scenario just testing it and it worked for us.

Good luck.

[astra]

Thanks you all for the overwhelming responses.

The system is going to be in production in this month. Therefore, someone will go to onsite and make the things working.

Thanks once again to you all and i ll get in touch again, in case of any problem.

Regards,
Amit

[Olivier Masse]

Besides ensuring you have a workable MP/iLO, especially at a remote site, it's always better (in my opinion) to elevate your privileges using sudo or RBAC to become root, using your own personal password, instead of doing a plain "su -". This leaves you a failsafe if someone changes or forgets the root password, as you just need to log in with your own account to reset it, or have another privileged admin do it for you.

I almost never use the root password except when I install a brand new system. It is kept in a safe place and reserved for emergencies.

Not publishing the password also prevents breaking the "imputability chain" of your admins, whatever that means. This will help you put your security auditors in pure bliss.

Just my two cents.