Root account locked out (Commercial Database Security)

[Mathieu P.]

Hello,

I came in this morning and root account was locked out. I still managed to login via console, but I want to know WHY it's been disabled. I don't want to unlock it until I fully understand the cause. (and perhaps trace down the individual who made it happen, if that is the case...)

I ran "getprpw -m lockout root" and got a lockout=0000000 output. I'm a bit confused there.

What could be the cause of such an issue ?


Thanks in advance !


MP

[Avinash20 · Accepted solution]

Your account might have got disabled because your system is Trusted.
By default If your type wrong password for user root for more than three times, the account gets locked

#/usr/lbin/getprpw -m lockout root
lockout=0001000

When you login via console, Account is disabled but console login is allowed.


You could check the bad login via

# lastb -R | more

[Avinash20]

You could find out who tried to login and from which IP addressed via

# lastb -R

[Patrick Wallek]

When you login via the console the account seems to be "automagically" enabled.

I just disabled root on one of my test servers and then logged in via the console. When I did a getprpw it also showed all 0's in the lockout section.

So, the act of logging in via the console automatically enables the account again. That does make it somewhat difficult to troubleshoot.

As said above, a 'lastb -R root' would show you the last bad login attempts for root.

[Mathieu P.]

"Your account might have got disabled because your system is Trusted."

That happened on the system wich I just ran the Audit Tools through SMH. I remember having to convert to a Trusted System.

Well, I guess I was paranoid for nothing then.
Thanks !

[Avinash20]

Yes, when you enable the Audit, you need to first convert the system to Trusted mode. :)