Password Problem

[roobala]

Hi All,

In our HP 9000 L1000 server running HP 11.00,
often its not accepting the Password for root,
where in that case we need to reboot the system in single user mode and apply the password.

This problem had happened for three times.
We have checked all the log files and even the crons which are there in the system.
Can some one help us in this regard.

Thanks in Advance.

[Dan Hetzel]

Hi Roobala,

Make sure you don't have the file /etc/securetty with a one line entry:
console
as this would prevent root login from all terminals but the system console.

In that case, either keep in mind that root should login on the console only, or simply remove the file.

Best regards,

Dan

[roobala]

hi Dan

Thanks for the reply.
But we don't have the file /etc/securetty which
you mentioned.

One more thing after changing the passwd from single user mode we could login as root from
any PC/Servers.

This problem is not persist always.

Any other possibilities?

Regards,
Roobala

[Dan Hetzel]

Hi Roobala,

I've never heard about the 'vanishing' password issue you're experiencing.

Let's try a few things:
- Are you running NIS or NIS+ ?
- What's the 'passwd' entry in /etc/nsswitch.conf, if any ?
- What kind of X11 server are you using ?
- Is your system trusted ?
- Do you have the same problem with logins other than root ?
- What is the exact message you're getting in case of an unsuccessful login ?
- Does 'su - root' work when login doesn't ?
- What version of the General Release Patch bundle did you apply ?

Dan

[roobala]

Thanks Dan once again,

These are the observations:

1. There is no NIS/NIS+
2. Entry in nsswitch.conf file is::

passwd: compat
group: compat
hosts: files [NOTFOUND=continue] dns
networks: nis [NOTFOUND=return] files
protocols: nis [NOTFOUND=return] files
rpc: nis [NOTFOUND=return] files
publickey: nis [NOTFOUND=return] files
netgroup: nis [NOTFOUND=return] files
automount: files
aliases: files
services: files

3. X11 Server: Swlist o/p is this, I don't
know how to see that.

$ /usr/sbin/swlist -l product|grep X11
PHSS_15840 1.0 X11 64 bit runtime cumulative patch
X11 B.11.00 HP-UX X Window Software


4. This is not a trusted system.
5. Other than root no one else is having problem.
6. Error message :: "Login incorrect"
7. su - :: "no sorry", Is not logging in.
8. There is no General rel patches, there are two patch bundles installed. refer the o/p.


XSWGR1100 B.11.00.45 HP-UX Extension Pack, May 1999
XSWHWCR1100 B.11.00.47 Hardware Enablement and Critical
Patches for HP-UX 11.00 (December 1999)




Thanks and Regards,
Roobala

[Dan Hetzel]

Hi Roobala,

If you're not running NIS/NIS+, then your /etc/nsswitch.conf file could be problematic.

Rename it to /etc/nsswitch.conf.old and edit a new nsswitch.conf with the following lines:

hosts: dns [NOTFOUND=continue UNAVAIL=continue] files
protocols: files [NOTFOUND=return UNAVAIL=continue]
services: files [NOTFOUND=return UNAVAIL=continue]
networks: files [NOTFOUND=return UNAVAIL=continue]
netgroup: files [NOTFOUND=return UNAVAIL=continue]
rpc: files [NOTFOUND=return UNAVAIL=continue]

This should hopefully solve your issue

Best regards,

Dan


PS: It could be a good idea to get the latest General Release Patch Bundle (Dec 2000) as yours is a bit old. Don't forget to check the 'match_target' if you install it.

[Patrick Wallek]

Part of the problem may be that you have some special characters in your password (like ! @ # $ % ^ & * ( ) ) that are causing you problems. I know, because I have experienced it, that the @ symbol will not work in a password. It works fine on Sun machines, but not HP. You might try an all alphanumeric password and see if that helps.

[Ajay Sishodia]

This might sound simple but lets cover all bases. Do you have anyother user in the /etc/passwd file with a uid of 0?? If so than every time this user changes his/her password will effectively change root password too without you knowing.

Ajay

[Jimmy Rogers]

I disagree with the above response. We have multiple accounts with uid 0, there is no problem when one changes a passwd.

This may be a security issue. I would check the .history.root file to see if anyone is changing the passwd. Also check crons to see if something funny is going on, like maybe /etc/passwd is being copied from some bogus file somewhere. Keep an eye out on the datestamp on /etc/passwd, run crons that perform a regular checksum, and a who -R command and e-mail you the results. Then if something funny happens you can narrow down a timeframe and see who was on the box at the time.