problems with su

[Richard Zawaski_2]

Hello all,
I am new to HP-UX. I am running 11i. I have created some local user accounts through the SAM interface. When I telnet into my system as a non-root user and try to su - as root, I enter the password and I get su: Sorry, as if I typed the wrong password. (The root password is correct, I set it, and I can telnet in directly as root). I have read the security man page, by default su should work. The file /etc/security does not even exist. There is also nothing helpful listed in /var/adm/sulog other than my failed attempts. Anyone have any ideas??

Thanks for your help,
Rich

Here is the output from /var/adm/sulog:

SU 07/27 10:36 - tc jgreen-root
SU 07/27 10:36 - tc jgreen-root
SU 07/27 10:36 - tc jgreen-root
SU 07/27 10:37 - td rich-root
SU 07/27 10:37 - td rich-root
SU 07/27 14:37 - td rich-root
SU 07/27 14:37 - td rich-root
SU 07/27 14:39 - td rich-root
SU 07/27 16:06 + td root-root
SU 07/27 16:07 + td root-rich
SU 07/27 16:07 - td root-root

[Steven E. Protter]

check the permissions on su

ll /usr/bin/su
-r-sr-xr-x 1 root bin 28672 Oct 4 2002 /usr/bin/su

SEP

[Richard Zawaski_2]

got the same output, permissions look good.

# ll /usr/bin/su
-r-sr-xr-x 1 root bin 24576 Nov 14 2000 /usr/bin/su

[Dave Olker]

Do you see any additional logging messages in the /var/adm/syslog/syslog.log file that might point to the problem?

Dave

[Sundar_7]

The file you should be looking at is /etc/default/security and not /etc/security.

Check if SU TO ROOT ALLOWED GROUPS is defined in the /etc/default/security file.

[Richard Zawaski_2]

No, there is nothing else in the syslog.log other than the duplicate info that is in sulog. For the last post, sorry, I meant to type /etc/default/security. Yes, this file does not exist. The only thing in 2 files in there are fs and useradd.

[Dave Olker]

Have you made any changes to the PAM configuration files? The files I'm curious about are /etc/pam.conf and /etc/pam_user.conf. If you've made changes to these files you could try putting the default versions of these files back and see if su works.

Dave

[Richard Zawaski_2]

No this is a fresh install of 11i. I did not do the install however. But, the pam.conf file looks to be default, no ref to the su command listed. Also, there is nothing in the pam_user.conf file, all the lines are commented out.

[Dave Olker]

Just to be sure, could you try doing a diff of /etc/pam.conf against the default file /usr/newconfig/etc/pam.conf and see if there is any difference between these files?

Dave

[Richard Zawaski_2]

No differences....

[Dave Olker]

Is trusted systems turned on by any chance?

Dave

[Richard Zawaski_2]

I dont think so, how would I tell? Is it part of the standard install?

[john kingsley]

This is a long shot, you said you were running "su - root", have you tried running "su root"?

[Dave Olker]

Trusted systems is included with the standard HP-UX 11i, but it is disabled by default. Shadow password support is also available for 11i but it doesn't ship with the system.

One way to tell if you have either of these products installed would be to look at the /etc/passwd file to see if the encrypted passwords for your non-root users are stored in the /etc/passwd file. If they are then I doubt either of these products are configured.

Also, are you using any backend name service for your /etc/passwd data, i.e. NIS, NIS+, LDAP, etc.?

Dave

[Richard Zawaski_2]

Checking the passwd file and trusted system is not enabled. I have already tried su root. Same result.

[Dave Olker]

Are you using any backend name service for your /etc/passwd data, i.e. NIS, NIS+, LDAP, etc.? Could you copy/paste your /etc/nsswitch.conf file contents here so we can see what the "passwd:" entry looks like?

Dave

[Richard Zawaski_2]

nsswitch.conf

passwd: files
group: files
hosts: dns [NOTFOUND=return] files
services: files
networks: files
protocols: files
rpc: files
publickey: files
netgroup: files
automount: files
aliases: files

[Dave Olker]

Ok, I'm running out of ideas. :)

In looking at the sulog output, the only field I haven't seen before is the "tc" or "td" entries. I'm used to seeing the device file name of the virtual terminal that you were using when you issued the "su" command. In my systems this looks like:

# cat /var/adm/sulog
SU 07/27 13:24 - ttyp1 dolker-root
SU 07/27 13:24 + ttyp1 dolker-root
SU 07/27 13:28 + ttyp1 dolker-root
SU 07/27 13:31 + ttyp1 dolker-root
SU 07/27 13:31 + ttyp1 dolker-root
SU 07/27 13:32 + ttyp1 dolker-root
SU 07/27 14:31 + ttyp1 dolker-root

On all of my systems I get the name of the device file like "ttyp1" meaning /dev/ttyp1 was used.

I don't know if there is any significance to the fact that your system is logging "tc" and "td" when you telnet into your system and issue the command, and mine all say "ttyp#". Could be significant, or it could simply be my lack of experience with the sulog format.

Does anyone else see "tc" or "td" in their sulog file for this field?

Dave

[Ermin Borovac]

Do you have any special characters in the root's password? If so, have you tried using just a combination of letters and numbers for the root's password?