Problem with chsh under HPUX 11

[Arnfried Kaiser]

Hello,
I can't change the login-shell from /usr/bin/csh to /usr/bin/bash with the "chsh"-command.
Also I can't change the login-shell from /usr/bin/bash to any other shell with the "chsh"-command.
The file "/etc/shells" contains all shells.
The error-message
"Couldn't change passwd/attributes for user" came from /usr/lib/security/libpam_unix.1 .
The patch PHCO_26089 is installed.
Is this an error in PAM ?

Thank you in advance.

[Armin Feller]

Please check if you are able to change the users passwds. For me it sounds a little like problems in NIS (passwds).

[V. Nyga]

Hi,

you could try it with SAM.
Go to 'accounts for users ..'
then 'users' and try to modify
shell.

Regards
Volkmar

[Arnfried Kaiser]

Our users must be able to change the login-shell, therfore I can't use the SAM.

To change the password is able.

Also change the login-shell from any login-shell to any login-shell is able so long as the is shell is not the bash but the shell is sh or ksh or csh.

[doug hosking · Accepted solution]

Are you by chance running on an NIS client?
If so, what about /etc/shells on the server?

Also, is the path an exact match?
For example, /bin/csh and /usr/bin/csh resolve to the same file but the validation routines aren't always smart enough to figure that out.

[U.SivaKumar_2]

Hi,

Do this as root.

#chmod u+s /usr/bin/chsh

And try again

regards,

U.SivaKumar

[doug hosking]

I'd be surprised if this is a permissions problem. On versions of HP-UX that support PAMified chsh, /usr/bin/chsh and /usr/bin/passwd should be hard links to each other. Given that the passwd binary would have to be setuid in order for a non-privileged user to run it, and that they can apparently change passwords on the system in question, that would imply that chsh is also properly setuid, unless someone broke the hard link somehow.

[Arnfried Kaiser]

Hi ,
thanks for the help and support!

The file "/etc/shells" on the NIS-server - that's the solution !
(The bash isn't installed on our NIS-server hence it is absent in this file.)

But I'm disconcerted:

"shells" is NOT a NIS-file and the NIS-server needs not to be a NIS-client.
Therefore I'm surprised, that the "chsh"-command on the NIS-client checks the "shells"-file on the NIS-server.
Is this wrong?
I think : yes. Then I'd think the login-shell-field in the passwd-file works as the home-dir-field - the home-dir of an user must not exist on the NIS-server so long as it exists on the NIS-client-host where the user is logging on.

[Ralf Buchhold]

Hello
I have the same problem.
but what is:

/etc/shell

what do you write to the file ?

Thanks
Ralf

[Lethuillier]

The /etc/shells file contains a list of login shells on the system. Applications use this file to determine whether a shell is valid. For each shell, a single line should be present, consisting of the shell's path, relative to root.

To see the legal shells for your system run 'man getusershell'.

This file is consulted by chsh to determine whether a normal user may change the login shell for her own account. If the command name is not listed, the user will be denied of change.

It is a requirement for applications such as FTP daemons which traditionally disallow access to users with shells not included in this file.

All shells referred to in /etc/passwd or in the NIS passwd map should be valid shells or links on this system and be listed in /etc/shells.