User can't login after root password set

[Mike Smith_33]

I was installing a piece of third party software using the root account on an hp 11i v1 system. The instructions were as follows

groupadd user
useradd user
usermod -G group user
passwd user

This was all done from the command line. Upon attempting to login to the account we got the message, your password has been changed by root after typing in the username at the login prompt. The password we set would not work. I went in using SAM and modified the password and the user was able to login.

Is this the expected behavior?

Also, even after setting the password, I still can't ftp into the account using the pasword. It just comes back with login incorrect.

Is this also expected?

[Granite]

Hi Mike,

As such we cant predict the behaviours of third party swrs unless tested througly.What is that software and wat for it is ..??
Primarly you should take a backup of impo system files b4 doing any system-level changes.Ignite is recommended.
If you are quite sure of the command executions of the software, just try doing manually as these are very simple commands.
Ideally it should work..!!!!

Regds, Granite

[Andy Torres]

Typing "passwd " on the command line should've prompted you to change the password for .

passwd -f will force the user to change it at next login. Then, log in as and set the password.

[Mike Smith_33]

The application is called Harvest Allfusion. It is change management software. The issue is not with the software. The software tells you to create an account to run it under. The passwd user command did prompt me for a password which i set. The problem is when you attempt to login using the username and just set password, the system won't let you in. That is the part I do not understand.

[Kofi ARTHIABAH]

Regarding the ftp issue, can you verify that the user's shell (pwget -n user last column) is listed in /etc/shells. ftpd uses the getusershell() and getusershell() requires that a user's shell must be listed in /etc/shells (if it exists - if it does not exist, then the user's shell must be one of the defaults) see man shells and man getusershell

hope this helps.
BTW is this a trusted system? see man security
kofi

[Andy Torres]

At the top you said the user was able to login after you set the password in SAM, so I assume you have a good shell. Kofi is on the right track. Can you see what shell the user is using?

[Granite]

Hi Mike,

Just try,

Just remove the account and try recreate :
1) userdel -r user
1) groupadd
2) useradd -m -G -k /etc/skel
3) passwd - set the passwd.

--> If not trusted(ie., no TCB user account database), ensure no * in /etc/passwd.
--> If trusted, check the account status using, /usr/lbin/getprpw .Your lockout value should be 0000000.

Regds,granite

[Mike Smith_33]

The user shell is /sbin/sh. I will look at the other responses now.

[Mike Smith_33]

I don't think I want to recreate the account I just want to better understand the behavior. If I set a password on an account using root at the command level, why can't that account login using that password and why does the message come up after the username is typed in. I have never seen this behavior before.

[Mel Burslan]

Mike

The message "your password has been changed by root" is coming to inform you that the password has been altered and you should have been notified of the change so that you won;t be caught surprised when your old password no longer works. This is a feature of trusted systems. Hence I am assuming your system is trusted.

Since you have a trusted system, more than likely, your new users get created as locked out from the get go, to give you, as root, to allow them into the system after everything has been correctly setup. Another security measure if you want to see it that way.

/usr/lbin/modprpw -l -m alock=NO $USERNAME
/usr/lbin/modprpw -k $USERNAME # to resets incorrect login count


after this $USERNAME should be able to login.

[Mike Smith_33]

Duhhh! I have found the solution after careful reading of the passwd man page.

The problem was that I put a # as the first character. What is strange to me is that I only did this after seeing what the systems generated as a passwd for me. It put in all kinds of weird chars including a #. I tried the passwd user and let it pick a pronounceable password and I was able to login directly and ftp to the account.