06-27-2014
Robin, Hicksd8, many thanks for the replies. I have managed to solve my issue but first to your questions. Unfortunately for me, since I’m working on a classified system, I can’t print or transfer any data from their to here easily. I could transpose the unclassified portions manually but that will no longer be necessary.
There are no login time restrictions in place.
I’m using Solaris 10.1 and the system is Global Command and Control.
Here is what I was able to do:
Log on to the non-global zone as Sysadmin via zlogin in a terminal window, log in as su and run the APM client via /h/COE/Comms/APM/APM_Client (or very close to that). Once it was up, I had full control of all accounts again and was able to update the seaman password. Note that it did NOT apply the change to any of the other non-global zones as would be the norm. So that required me to log out fully, log back into secman via the non-global zone and change the password to a throwaway password. Log out, log back in and change it yet again but this time is synced up with the other non-global zones.
There is another way to do this via the terminal window and some creative su logins but I have to get my notes to make sure I post the correct login sequence.
That said, I’m sure it is clear to you that I am no unix expert. I have a ton of experience working as a GCCS operator but only a little as a sysadmin. I am learning as I go and would like to pick your brains as I learn. I have also imaged everything (controllers, servers, workstations) so backups are in place. More to follow and thank you again.
Mike
9 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
I am using AIx 4.3.3 and was wondering what the command was to keep users from logging in. I want to be able to do maintenance and keep the users out. Can anyone help? (7 Replies)
Discussion started by: cgillett
7 Replies
2. UNIX for Dummies Questions & Answers
Hi, I am extremely new to UNIX and was recently promoted to administer the system for a small company. Anyhow, the time came for passwords to change, and I made the huge mistake of entering in the command (as root)
passwd -l
After logging out (oblivious to what would happen next), the root... (4 Replies)
Discussion started by: newbieadmin
4 Replies
3. AIX
Hi,
We are using 4.3.3.0 and I would like to make a global change to the "number of failed logins before user account is locked"
Any ideas, other than using SMIT one user at a time.... ???
Thanks... Craig. (2 Replies)
Discussion started by: stumpy
2 Replies
4. AIX
I want to know if there is any easy way of stopping 1 user from using su? perferabily any su but I can make do with not allow him to su to root but allow other user to su to root. (3 Replies)
Discussion started by: daveisme
3 Replies
5. Red Hat
Hi all;
I m using Red Hat Enterprise Linux Server release 5.1 (Tikanga) and I'm trying to setup password lockout policy so that a user account locks out after 3 failed attempts.
Here are the entires of my /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes... (1 Reply)
Discussion started by: maverick_here
1 Replies
6. UNIX and Linux Applications
What is the best way to implement account lockout in openldap? I have an openldap server with Ubuntu desktop client connecting to it for authentication. I want he accounts to locked out after say 5 failed authentication attempts
I have enabled ppolicy layout in slapd.conf.
overlay ppolicy... (0 Replies)
Discussion started by: nitin09
0 Replies
7. Red Hat
On a redhat linux 4 server, how to find if there is an account lockout duration is set. Is it configured under pam or /etc/shadow? what entries I need to find out? Is it pam_time.so module?
I desperately need an answer because on one of the servers, no one was able to login through any account... (4 Replies)
Discussion started by: Tirmazi
4 Replies
8. Red Hat
having account lockout issues with an RHEL 5 server. My users are getting locked out for 10 minutes after one failed login attempt even though /etc/pam.d/sshd is configured for 5 failed attempts:
auth include system-auth
auth required pam_tally2.so deny=5 onerr=fail... (1 Reply)
Discussion started by: nerdalert
1 Replies
9. Red Hat
Good day. I have setup hardening the password (test system so far) prior to doing any work on production. Here is what I have set.
Snippet from /etc/pam.d/system-auth
auth required /lib/security/$ISA/pam_env.so
auth required /lib/security/$ISA/pam_tally.so... (3 Replies)
Discussion started by: smurphy_it
3 Replies
LEARN ABOUT DEBIAN
kas_unlock
KAS_UNLOCK(8) AFS Command Reference KAS_UNLOCK(8)
NAME
kas_unlock - Unlocks a locked user account
SYNOPSIS
kas unlock -name <authentication ID>
[-admin_username <admin principal to use for authentication>]
[-password_for_admin <admin password>] [-cell <cell name>]
[-servers <explicit list of authentication servers>+]
[-noauth] [-help]
kas u -na <authentication ID>
[-a <admin principal to use for authentication>]
[-p <admin password>] [-c <cell name>]
[-s <explicit list of authentication servers>+] [-no] [-h]
DESCRIPTION
The kas unlock command unlocks the Authentication Database entry named by the -name argument. An entry becomes locked when the user exceeds
the limit on failed authentication attempts, generally by providing the wrong password to either an AFS-modified login utility or the klog
command. Use the kas setfields command to set the limit and the lockout time, and the kas examine command to examine the settings.
To unlock all locked user accounts at once, shutdown the kaserver process on every database server machine, and remove the
/var/lib/openafs/local/kaauxdb file from each one. The kaserver process recreates the file as it restarts.
OPTIONS
-name <authentication ID>
Names the Authentication Database entry to unlock.
-admin_username <admin principal>
Specifies the user identity under which to authenticate with the Authentication Server for execution of the command. For more details,
see kas(8).
-password_for_admin <admin password>
Specifies the password of the command's issuer. If it is omitted (as recommended), the kas command interpreter prompts for it and does
not echo it visibly. For more details, see kas(8).
-cell <cell name>
Names the cell in which to run the command. For more details, see kas(8).
-servers <authentication servers>+
Names each machine running an Authentication Server with which to establish a connection. For more details, see kas(8).
-noauth
Assigns the unprivileged identity "anonymous" to the issuer. For more details, see kas(8).
-help
Prints the online help for this command. All other valid options are ignored.
EXAMPLES
In the following example, an administrator using the "admin" account unlocks the entry for "jones":
% kas unlock -name jones -admin_username admin
Administrator's (admin) Password:
PRIVILEGE REQUIRED
The issuer must have the "ADMIN" flag set on his or her Authentication Database entry.
SEE ALSO
kas(8), kas_examine(8), kas_setfields(8), klog(1)
COPYRIGHT
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas
Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
OpenAFS 2012-03-26 KAS_UNLOCK(8)