root password has expired

[Jack_126]

Hi,

while doing su from normal users id getting message "password has expired".

This is HP-UX system. now how I can recover the root password. needs immediate help on it.

Regds
Jack

[Stephen Keane · Accepted solution]

Login at the console?

[Rick Garland]

Do you have a window open with root access?

Trusted system:
/usr/lbin/modprpw -k root

If no window open, login as root on the console.

[Rick Garland]

Whoops...

Should be /usr/lbin/modprpw -v root

This will refresh the acct

[john kingsley]

You can to su into an account with an expired password. Try accessing the root account using login command, or try telneting to the box and then login as root.

[john kingsley]

Typo in my previous post.

SU does not support logging into an with an expired password. This is because is doesn't support prompting for old/new passwords to allow you to change the password.

[Matthew_50]

If possible, boot into single user mode, then change the root password.

[Jack_126]

hi ,

Sorry forget to tell that I connect remotely.
I got it I have to use console and then go to single user mode and then with passwd
command change the passwd.

Now the problem is that system is not having any console connected. Could you suggest what kind of console I have to use and it will connect to which port.
The system is HP9000/800/K460.

Thanks

[Torsten.]

Use a laptop with hyperterminal or any other terminal emulation (hp or vt100 term). Set speed to 9600.

[Rick Garland]

Don't have to go to single user mode. Just login on the console.

root has access on the console always.

[Torsten.]

There is a 9-pin serial port labeled (console) on the core I/O card (back view).

[DCE]

Jack,

Be sure to use a null modem cable for the connection

Is sudo installed? I believe you can sudo to root, even with the root password expired. Once in, you can reactivate/change the password.

Dave

[Jack_126]

Hi Rick Garland,
You said that,Don't have to go to single user mode. Just login on the console.
root has access on the console always.

If I use Hyperterminal it will prompt for login.
here if I use root
I have to give the password:

as I said the password is expired,then how it will allow root to login. Please explain,because if its possible will be very usefull without going to single user mode.As i don't have to reboot the server.

thanks

[Rick Garland]

The root has access to the console.

Another example is if the root account is locked and disabled. If this happens and there is no root window open then you would need to boot into single user mode and unlock the account. This can be quite an interruption to the daily business.

In general, root would not login anywhere else except the console. (This is not always true but I believe it should be)

If you are running 10.20 with C2 security then this changes. Not sure about 11i.

[Rick Garland]

Just verified with HPUX 11.11 on A class system.

I expired the root passwd. I could not login from my desk. I login on console and it goes through the routine of saying that password has expired, change passwd, you want to pick (p) a password?

Old password?


This is a trusted system

[Jack_126]

Hi DCE,
Is sudo installed? I believe you can sudo to root, even with the root password expired. Once in, you can reactivate/change the password.

How to check if sudo installed?

Regards
Jack

[DCE]

sudo is usually in /usr/local/bin.

If your ID is authorized to use sudo then

the syntax is /usr/local/bin/sudo su -

It will ask for a password - enter YOUR password not root's. You will then be at a root prompt.

Dave

[Jack_126]

Hi DCE,
I am able to change the root passwd with sudo as I found one user who was authorised to use sudo.
When I tried with my id it says "not the sudoers file".

Now Could you please tell me how I can add my user-ID to use sudo.

Thanks
Jack

[DCE]

the people sllowed to sudo are in a file called /etc/sudoers. There are several ways to modify, depending on the version you have.

visudo is one way, visudoers is another or if you sre very careful, you can vi the file directly.

You can download the latest copy (and instructions from

http://hpux.cs.utah.edu/

[yut]

Hi jack,

you said "I am able to change the root passwd with sudo as I found one user who was authorised to use sudo.
When I tried with my id it says "not the sudoers file"."
Now Could you please tell me how I can add my user-ID to use sudo.

answer:
edit sudoers file, issue command /usr/local/sbin/visudo, then add user that you want to authorised to use sudo, below for example:
# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
jack ALL=(ALL) NOPASSWD: ALL

save your sudoers file and try again.

or you can set NULL root password using this command/usr/sam/lbin/usermod.sam -F -p "" root


regards,

-yut-

[Arunvijai_4]

Sudo is part of HP Internet express as well, you can get it from

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

[SGUX]

when the system is backupped using a central-backup-environment (e.g. DataProtector) [on a trusted-system] you could try restoring /tcb/files/auth/r/root from a date earlier then when the password was expired.

[Jack_126]

Hi,

I have put my user in sudoers file.
jack ALL=ALL
when I run command /usr/local/bin/sudo su -
it ask for the sudo password. I am trying to put the same password of the user but its not accepting.
Now where I have to put the sudo password for this user.

Second if I dont want to use password where I have to put this.when I try like.
jack ALL=(ALL) NOPASSWD: ALL
and run sudo su -
it says fatal error.

Kindly suggest how to go about for both the options.

Regards
Jack

[Rick Garland]

For you as the root user.

In the sudoers file is an entry talking about the members of the wheel group and there are 2 lines, 1 line with a passwd and 1 line without a passwd.

You can remove your "jack ALL=ALL" entry and do this;
Make the group wheel on your HPUX system using the groupadd command. Place your account, jack, into this group. Logout and login. Do the ID command, you should see that you are now a member of the wheel group.

Here is the entry in the sudoers file I was referring to

# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL

Uncomment that line and you will be able to run all commands without a passwd.

Are using 'visudo' to modify the sudoers file? If not then any changes you make will have no effect while invoking sudo

[Jack_126]

Hi,

Thanks for all support.

This query is closed


Regards
Jack