Password change from root not working correctly

[Joshua Simpson]

Okay, this one is striking me as odd. We have a very small, very old Unix network (that being two, read them, two computers together). Do to the screwups of various users and administrators before me, the passwords on secman account has been lost into the abyss. I decided to do a complete password change to bring the system back into decent security.

I went into the sysadmin account, opened xterm as sysadmin, used su root to switch to root. Then I used the passwd command to change the passwords on all the accounts. No error messages, no problems.

Until I logged out and tried to log back in. It told me my login was incorrect. Tried the old password. Same thing. Same on all the accounts.

Before you start offering help, I should warn you that I am certainly not the typical admin of a Unix network, in the fact that I know almost nothing about the software side of these systems. I'm a hardware tech forced into the position, so be gentle.

Help is greatly appreciated (anything that gets the Cap'n off my back is good).

[Sridhar Bhaskarla · Accepted solution]

Hi,

First ensure these systems are not trusted (if they are HP systems).

#/usr/lbin/getprpw root

If it gives any output other than 'this system is not trusted' then the system is trusted. If the system is trusted, make sure these logins are not disabled.

#/usr/lbin/modprpw -k

and then login with again.

Ensure you used the following command as root whether the system is trusted or not, to change the password.

#/usr/sbin/passwd

If that gives you any trouble, use

#/sbin/passwd


-Sri

[Steven E. Protter]

Whether the system is trusted or not, if you have root access, you can edit the /etc/passwd file and temporarily zero out the password field.

Then immediately set the password.

If its HP-UX and trusted its a different file.

cd /tcb/files/auth

there are letter directories for the entire alphabet. root would be a file in the r directory.

You can almost always get root access at the console as follows:

boot

interupt at the 10 second prompt

hpux -is

Usually this is not password protected. You can now do virtually anything you need to clear passwords so that you can eventually set them in normal mode.

SEP

[harry d brown jr]

Check to see if /etc/securetty exists. If it does, then rename it to /etc/orig_securetty.

You might also have to bounce getty and/or inetd.

to bounce inetd use:
inetd -c

to bounce getty
ps -ef | grep getty
kill PIDofGETTY

live free or die
harry

[Bharat Katkar]

Simpson,
What i understand is you changed the root passord and now you are not able to login as root. Finally root password is lost.
In this case you need to reboot the system (if you have any other user priveledged to shutdown the system) or simply power it off.
Power on the system and go to PDC prompt (i assume this is a HPUX System). Halt at boot process. You see the prompt as:
Main Menu> bo
Interact with IPL> yes
ISL> hpux -is

This will take you into single user mode without asking for any password.

After getting the hash prompt simply type passwd.
# passwd
New Password:
Confirm Password:
#
Remeber the password you typed and then

# reboot

This will bring the system in multiuser mode. Now try logging in as root.
I assume your system is not trusted.

Hope that helps.
Regards,

[Joshua Simpson]

Actually, the root password is the only one that is working correctly (and a good thing, too, as single-user mode has a password on these systems; not my choice).

Also, the system is trusted, another thing I'm not authorized to change.

I haven't gotten a chance to implement any of the suggestions you fine folks have suggested, but I did work with it some more yesterday evening. Interesting results:
- Changed passwords to less than 8 characters. All accounts can now be logged into from both prompt and GUI login screen.
- For some reason, the system WILL NOT acknowledge a password longer than 8 characters at the login screen (though I can log into them through from another account).

If anyone has any ideas why this is working this way, I'd love to hear them. Oh, did I mention that "the world's finest Navy" is using HP-UX 5.1? Probably help to know that.

Also, still having problems with the "secman" account on my second machine. Despite the fact that the password has been fixed, I still can't login to it from the login screen, and attempts to switch users to it give the message "This account has been disabled." I tried using the "modprpw -k " command, but the account still doesn't work. Ideas?

[Joshua Simpson]

My mistake, we are using HP-UX version 11. The overall software load (which includes the OS plus a bunch of speciality software) is version 5.1. Just thought I'd put that up there for accuracy.

[Todd McDaniel_1]

Josh,

The reason >8 char passwords dont work is b/c you have a trusted system.

passwds are mandatory <=8 chars...

[Todd McDaniel_1]

I think you can modify it with /etc/default/security.

man security


you will have to create this file and mod the changes there to allow >8 char passwords.

CAVEAT: I have never used this on trusted so buyer beware.