root password on the trusted system

[Vishal Phlad_1]

Good Day All

I have a development server and its running HP_UX B11.11 on it and it's running as a trusted system. The problem that i'm experiencing is that whenever the root's password expires i have to take down the server to single user mode, untrust the system, delete the password entry in the /tcb/files/auth/r/root and reset the root's password. I read on ITRC that i have to install sudo and give a normal user access as root so that i can change the root's password without having to take down the server. I installed sudo and tested it but now the problem is that:
- i log in as a normal user
- sudo vi /etc/tcb/files/auth/r/root
- sudo /usr/lbin/tsconvert -r
- sudo root passwd
- then, i can log in as root with the new password
- and when i convert back the system to a trusted system
i cant log in as root, it asks for the old password.

What i would like to know is that, is there a way to have a trusted system and the root password doesn't expire ??

[Robert-Jan Goossens]

HI Vishal,

Try,

# /usr/lbin/modprdef -m mintm=0,lftm=0,exptm=0,expwarn=0 root

Regards,
Robert-Jan

[Vishal Phlad_1]

do i have to untrust the system to run this command??

[Mark Nieuwboer]

No you won't have to change to u non trusted system. see the man pages of modprpw.

grtz. Mark

[Rajeev Shukla]

Hi Vishal,
I cant understand one thing, you are running a trusted system and if the root password expires why do you have to reboot the system into single user to reset the password?
If the password gets disabled/expired console login as root is still allowed and then you can change the password.

Cheers
Rajeev

[Lawrence Mahan]

Do you have your /etc/securetty file set-up? If so what is in the file? For security you should only have a single line in the file. This line should be:

console

This way only the console port has initial root login rights. With this set-up you should be able to login as root on the console regardless of wither the password has expired or not.

[Patrick Wallek]

If the root password expires, and you have full sudo access, all you need to do to reactivate root is:

# sudo /usr/lbin/modprpw -k root

Then you can login as root again.

[Bill Hassell]

None of those steps are necessary. If the root user password expires, you simply provide a new one. Login/paasswd will ask you for the old one, and then the new one.

Perhaps you mean that the root account is locked. That's different and can easily happen if someone tries to login too many times. You want this account locked because it may be a hacker trying to get in. In that case, you cal *ALWAYS* login through the console (not telnet) with the root account locked.

There is never a reason to use tsconvert -r

[RAC_1]

First thing is when you convert system to trusted mode using command line, (/etc/tsconvert) all passwords will expire. So if you convert system to trusted mode, you should do as follows.

/etc/tsconvert;/usr/lbin/modprpw -V
man modprpw for details.

But, you convert system to trusted mode with SAM, you do not need to do all this.

Now, why root password is expiring??
/usr/lbin/getprpw -m root
Check for exptm, lftm, expwarn and mintm. All should be set to 0, if not set it to zero

/usr/lbin/modprpw -m mintm=0 root and so on for all baove settings. OR you can do all this through SAM.

Anil