HPUX - root account lock

[walter crasto_1]

Hi,
I am not able to login as root on my HPUX 11i server; it is giving me error that root account is disable please contact system administrator.

I have tried booting in single user mode & modified /etc/passwd file & now my root entry in /etc/passwd file look like this
root::0:3::/:/sbin/sh

But still I am facing same problem. Please suggest the solution.

Regards
Varian

[Elmar P. Kolkman]

Have you tried su to get to the account?
Is your system converted to a trusted system by any chance? In that case you need to look for /tcb/auth/r/root I think for the password of root.

If su works, you could reset the root account using SAM...

[T G Manikandan]

if your system is trusted.

Login into single user mode

Untrust the system

Remove the encrypted entry from the /etc/passwd file as before.

Trust the system again.

Thanks

[walter crasto_1]

Hi,

I am not able to su.
Regarding trusted system; I can see that /tcb/files/auth/r/root file but don't know how to verify whether my system is trusted or not.
Also let me know what type of entry I need to check in /tcb/files/auth/r/root for the trusted system.

Thanks in advance,

Varian

[T G Manikandan]

/tcb/files/auth/r/root

having this I think the system is trusted.

you can also do a

#getprpw

it not trusted you get a message not trusted.

[G. Vrijhoeven]

Varian,

Strange, the file looks ok.

Are the rights on the passwd file ok?
Do you have a trusted system? /etc/tcb
Do you have a file called /etc/securetty?
Did you try makeing a second root account ( id 0)

Gideon

[Elmar P. Kolkman]

If you have another system which is trusted too, you might try to replace /tcb/file/auth/r/root on your problem-server with the file from the working machine... But you will have to do this in single user mode. So copy the file to a place you can access when only / and /stand are mounted, reboot the machine in single user mode and copy it to the right place, since you need root access to change files in /tcb/files/...

Or run the first solution from T G Manikandan.

BTW: if you have /tcb/...., your system is converted to trusted and passwords in /etc/passwd will be ignored. That's why your change to /etc/passwd didn't work.

[walter crasto_1]

Hi,

Can anybody let us know how to untrust the system. I can boot machine in single user mode.

Thanks & Regards

Varian

[Elmar P. Kolkman]

First check the tcb file for root. If it contains a field with u_lock, remove it and you should be able to login as root again.

[Alan Turner]

It sounds as if your root account is locekd out on a trusted system. The default on conversion to a trusted system is that accounts will be locked out after 3 failed attmepts - even root. You can, though, change this limit. I've only ever done this using sam:
Accounts for Users and Groups --> Users
choose the root account
choose Actions --> Modify Security Policies --> General User Acc. Policies, then change "Unsuccessful Login Tries Allowed" from 3 to another number (max 99).
By the way, you also ought to be able to use sam to unlock the root account, provided that you can sucessfully "su". If you can't "su", then lets hope the direct edit to remove the u_lock entry works.
By the way - you can also set the system to require entry of a password before booting to single user mode - just as well that this was not enabled, or you would not have been able to get in in single user mode.

[T G Manikandan]

# /usr/lbin/tsconvert -r
Change the passwd and again make the system trusted
# passwd root
# /usr/lbin/tsconvert

[walter crasto_1]

Hi All,

Thanks a lot for your prompt suggestions,
My problem has been resolved by /usr/lbin/tsconvert -r command & by removing u_lock entry in /tcb/files/auth/r/root file.

Thanks & Regards
Varian

[Carlos Fernandez Riera]

Once you know it is a trusted system, you must read man pages for modprpw and getprpw.

There are available on 11.11 only.

I guess you was able to recover root access and avoid to convert passwd files twice with that commands.

getpr and modpr is under /usr/lbin.

[Bill Hassell]

Some clarifications:

- When root is locked out, you can always login through the 'real' system console.

- /tcb is present only when your system is trusted (unless someone arbitrarily created the directory) and it will contain a /tcb/files directory.

- you don't have to un-trust the system to fix the root entry. You can unlock any account using /usr/lbin/modprpw -k .. However, for root, you'll need to be in single user mode, and you must mount /usr first. That is the preferred way rather than trying to edit the /tcb/files/auth/r/root file directly

- The man pages for prpwd, modprpw and getprpw are available at http://docs.hp.com