Recovering the root user account

[Andrew Kaplan]

Hi there --

Is it possible for someone to delete the root user account, and if so how can the account be recovered? The system in question is HP-UX 11.11. Thanks.

[Kevin Wright]

well, sure. recover with a useradd, restore /etc/passwd;/etc/shadow from backup.

[Luis Cardenas Perez]

Hi,

You need to be able to start on single user mode. (You would need a console to do that)

When "10 second to start..." message display abort startup and start manually, then select "interact ..".

execute:
hpux -is

on this mode you can change root password with
passwd command.

[Mridul Shrivastava]

I understand if another user have superuser privileges then root can be deleted.
If it is the case then you have to restore the old passwd file.

[Shrikant Lavhate]

Hi Andrew,

If account is deleted then you can recover it by restoring /etc/passwd and /etc/shadow from backup but if account is locked by some reason or if there is any password issue with account then booting system in single user mode and resetting password is best choice.

-=ShRi=-

[Patrick Wallek]

If you delete the root account, I'm not sure you really have much hope of doing anything.

If you are not logged in, you certainly will not be able to log in. I am not sure the system would boot into single-user mode if root doesn't exist.

If the root user is deleted, you may be forced to recover your system from an Ignite/UX make_tape_recovery or make_net_recovery backup.

[whiteknight]

Andrew,

You need to boot up

1) single user mode first (hpux -is)

2) cp /usr/newconfig/etc/passwd /etc/passwd

3) init 3

At least you can boot up into multiuser mode and after that restore original password to the system

WK