Regarding a users password change.

[raiden]

Hello ,

I am facing a strange problem . A user "ABC" claims that when he logged in today morning he got a message that his password has been changed by user "XYZ". But when i checked the sudo permission of user "XYZ", he doesnt have any sudo rights. He just has sudo to an application ID. Please can you help me to explore what could be the possibilities or problem.

Regards,
Amogh

[OFC_EDM]

Check the UID of each user. They should be different. If they're the same then they're actually the same user and could change each others password I believe....although I haven't tested that.

Which OS are you on?

[raiden]

Hi Kevin,

I am on HP-UX 11.23. I have checked the UID . Both are different. So its getting even more confusion.

Regards,
Amogh.

[Rohini Deshpande]

Hi Kevin,

Does that application in any case have a facility to change password?

On HP-UX, users can get sudo permissions in the following ways
1) Using RBAC (Role based access control). In this case XYZ should have the privilege to run "passwd" command.
2) sam -r (Restricted sam) - In this case user XYZ should have permission for "ugweb or Accounts for user & groups" area of SAM from where he can change password.
3) SMH - System management homepage
Administrator privileges for XYZ can give him permission to change password using ugweb/Accounts for Users & groups tool from SMH.

Regards,
Rohini

[Rohini Deshpande]

In the above mail I meant the ways to get sudo like privileges & not exactly sudo permission.

[Dennis Handly]

Do you have the exact message?
I don't think I have ever seen a message like that. And why would a message be sent?
I.e. if the password was changed, how could you login?

There also is a similar thread today:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1278859