root account disabled. Can't change password via GSP either

[Joe Profaizer]

I have an L2000 and the root account is disabled, so I logged in through the GSP and when I type my password it returns:
Console Login: root
Password:
Account is disabled but console login is allowed.
Last successful login for root: Tue Aug 16 13:00:08 CST6CDT 2005 on pts/5
Last unsuccessful login for root: Wed Aug 17 10:23:12 CST6CDT 2005
Your password has expired.
Choose a new password.
Changing password for root
Old password:
Sorry.
Login aborted due to no password.

So when I enter the old password, you see that I get the "Sorry" message. This is a trusted system by the way.

Any suggestions other than booting into single user mode?

[Mel Burslan]

if you have another system that exists in the root's .rhosts file as root equivalent, you can try coming form this system and see if it works but I am sure if you had such a system you would have tried it already.

Other than that, boot to single user unfortunately.

[Geoff Wild]

Is the account locked?

grep root /etc/passwd

is there an * in the passwd field?

If yes, try

passwd -d root

Then try setting the password

passwd

Rgds...Geoff

[DCE]

If you have sudo installed, you should able to sudo su - and get in as root. Once there you can reset roots account with the modprpw -k root command. If no sudo, then you will have to come up in single user mode.

[Joe Profaizer]

If I were to create a share via SAMBA, can I untrust the system by moving files or renaming them instead of using SAM. Root is the only username we can access sam with.

[Geoff Wild]

"If I were to create a share via SAMBA, can I untrust the system by moving files or renaming them instead of using SAM. Root is the only username we can access sam with."

Uh...why would you want to do that? Very dangerous and could result in an unbootable system....

Isn't your issue "root account locked"?

As far as sam goes, you can setup Resticted SAM for other users...with sam -r

Rgds...Geoff

[Pat Lieberg]

If you have no alternate means of accessing the system (i.e. ssh, sudo, etc) then you will most likely need to boot into single user mode.

It sounds like your root password is expired, but the account is disabled. Perhaps there is a bug which prevents console access in just this kind of situation?

[Joe Profaizer]

Could be a bug indeed. We even restored the file /tcb/files/auth/r/root from 7/30. The account was reenabled, but indeed expired again and I couldn't reset the password from the GSP when prompted for "Old Password"

[RAC_1]

If you alternate means of logging in as root, do as follows as a root user.

# /usr/lbin/getprpw -r -m lockout username

To decode what is returned, note that the position (left to right) represents:

1 past password lifetime

2 past last login time

3 past absolute account lifetime

4 exceeding unsuccessful login attempts

5 password required and a null password

6 admin lock

7 password is a *

NOTE: If 0000000 is returned proceed to step 2. If not try the steps

below.

If the following is returned

0100000 (means "past last login time")

use the modprpw command to correct this as follows:

# /usr/lbin/modprpw -m llog=0 username

Now, the getprpw command, should get back a response of:

0000000

The account is now re-activated. Skip step 2. You are done.

Do the following to NULL out the passwd field on this account and change the passwd. It will NOT prompt for the old passwd.

2. # /usr/sam/lbin/usermod.sam -F -p "" root

[Mel Burslan]

I think you are mis-perceiving the password expiration. Your 7/30 dated file does not have any different information than what it is today. the encrypted password hash has the date of last password change and when you login, or try to login, there is a calculation made to figure out, depending on your password aging policy, if your password has expired as of today or not. So, it is quite expected that you had not been successful logging in and changing your password. But again, when you login from the console, none of these checks should have taken place at all. I think your security policies, regarding root accounts were too tight in my opinion.

[Bill Hassell · Accepted solution]

How many characters are you typing for the root password? Idf this system was recently converted to Trusted and the root password was 9 or more characters, the extra characters were silently ignored in the un-trusted system. But when converted to Trusted, all passwords must be entered as 8 characters or less until you change the password, at which point the additional characters become significant.

[Ranjith_5]

Hi Joe,

Check if your old password contains special character like @, # etc. in that case you will need to use \ just before typing such characters in your password.on console it wont allow you to directly login with root account if the password contains special characters.

Try login in with some other user name. Do an su - root. Then here change the password.


Regards,
Syam

[Joe Profaizer]

Bill,
I remember meeting you at HP World. Thanks......You 'da Man!!!

Thank you very very much