Trusted Mode Root Lockout

[Randy Gelineau]

Is there a way to force trusted mode to NOT lockout the root account?

We have not identified exactly why the root account is getting locked out but we think it is do to logs filling up.

[RAC_1]

On trusted system, three unsuccessfuly logins attempts will lock the account. This is controlled by umaxlntr.

/usr/lbin/getprdef -m umaxlntr
/usr/lbin/modprdef -m umaxlntr=5

Now 5 unsuccessfult logins attempts will lock the account

Anil

[Bharat Katkar]

HI,
Have a look at the doc attached.
Hope that helps.
Regards,

[Randy Gelineau]

root will not be able to get into the machine to run any commands if its account is locked.

I would rather not boot into single user mode to unlock it. This is the situation we are trying to avoid.

[Darren Prior]

Hi Randy,

You can change the values for root either as RAC suggested, or via SAM. It's also worth looking at the output of /usr/lbin/getprpw root regularly to see attempted login times and ttys to give you a clue as to what's going on.

Which logs do you suspect are filling up? If your system is configured such that / can fill up with logs then it's possible that this is the cause. However, in this instance I believe that root is only locked out because there's no way of writing logs when you attempt to login, rather than being locked out within the /tcb area.

regards,

Darren.

[RAC_1]

You can log in through console.

Anil

[Sridhar Bhaskarla]

Hi,

If the root account is locked, it will allow you to login from the console and you can enable the account by running "modprpw -k root".

If you do not want your root account locked, then turn off (make it 99) maximum number of unsuccessful attempts as previously mentioned. If you are planning to do so, then make sure you have /etc/securetty file so that no one will be able to login from other than console. Have a mechanism to notify you after certain number (say 10) of successive unsuccesful attempts so you can keep an eye on malicious attempts.

To find out why root account is getting locked, look at your 'lastb' and the 'unsuccessful su - root' entries in /var/adm/sulog.

-Sri