Setting root pasword to null with force change on first login


 
Thread Tools Search this Thread
Operating Systems AIX Setting root pasword to null with force change on first login
# 1  
Old 03-24-2017
IBM Setting root pasword to null with force change on first login

Greetings All

I have a specific use case: for the deployment of a standard AIX Golden Image via mksysb, I have been requested to set the root user password to NULL with forced change on first login. Currently the admins need to remember when the Golden Image mksysb was created to calculate the root user password for console access.

I would like to include this logic into the script that generates the golden image mksysb:
  1. Am I the golden image [Y|N]?
  2. If [Y], set root password to NULL and force change on first login
  3. Generate mksysb
  4. If [Y], change root password back (I have a working process for this part and I don't want some charlatan sticking a back door into my GI Smilie )

It is step 2 I need help automating please.

Thank you
m

Last edited by rbatte1; 03-24-2017 at 09:09 AM.. Reason: Converted text based number list to formatted number list with LIST=1 tags
# 2  
Old 03-24-2017
Would it not be easier to have a procedure that blanks the root password after the recovery from the GI is done?


Just a thought,
Robin
# 3  
Old 03-24-2017
Greetings
Quote:
Originally Posted by rbatte1
Would it not be easier to have a procedure that blanks the root password after the recovery from the GI is done?
Either would be work; do you have the code to do so (or can point me to a doco I may use to build my own)?

m
# 4  
Old 03-24-2017
Why not fix a known password to your team for the GI thats asks you to change root pass word after recovery? ( I usually used to have one that is changed per Year: as I used to archive all good GI... In case I were arked to put a box say, in OS cofiguration as of Jul 2009...)
# 5  
Old 03-24-2017
quick and dirty, without any warranty

Code:
grep -vp /etc/security/passwd /etc/security/passwd.old
grep -p root /etc/security/passwd | sed 's/password = \(.*\)$/password =/' >/etc/security/passwd.new
cat  /etc/security/passwd.old >>/etc/security/passwd.new
mv /etc/security/passwd.new /etc/security/passwd
pwdadm -f ADMCHG root

# 6  
Old 03-25-2017
You create the golden image presumably via some NIM-procedure. My suggestion is to have a post-install customization script which sets the root password to blank and raises the ADMCHG flag so that the next root logging on is required to set the PW.

It being weekend I have no AIX system at hand to test it, but that should work:

Code:
chpasswd < $(print - "root:")

See the man page for the chpasswd command for details.

On another thought you may want to include such a post-install step into the regular NIM-setup of new systems so that - regardless of what golden image was delivered - the root password is always set to a constant value which you can tell the administrators. In regular intervals (like once a year, ...) you just change this post-install-script so that ALL newly iinstalled systems are set to this new password initially.

I hope this helps.

bakunin
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Can a root role change the root password in Solaris 10?

i do not have root on a solairs 10 server , however i do have the root role, i was wondering if I can change the root password as a a role with the passwd command? I have not tried yet. and do i have to use the # chgkey -p afterwards? i need to patch is why i am asking. thanks (1 Reply)
Discussion started by: goya
1 Replies

2. Red Hat

how to force a user to change the password

RHEL 5 update 4. How to force a user to change the password at his next logon. Thanks in advance. (8 Replies)
Discussion started by: uxadmin007
8 Replies

3. UNIX for Dummies Questions & Answers

Setting up VSFTPD (force SSL?)

Hi all, Im having trouble setting up an FTP server and forcing SSL. At the moment i can connect to the server externally using normal FTP but when i try FTP with SSL i get STATUS:> Connected. Exchanging encryption keys... ERROR:> SSL: Error in negotiating... (5 Replies)
Discussion started by: mokachoka
5 Replies

4. Solaris

Force user to change passwd on first login

Hello All, How to force user to change his login passwd on his first login in solaris 10 ? while adding user do we need to set the password in theis case?? (7 Replies)
Discussion started by: saurabh84g
7 Replies

5. Shell Programming and Scripting

force to change password(by modifying /etc/shadow)

hi by modifying /etc/shadow how can I Force a change of password so that user has at least 1 week to login? I did it by using: echo "enter username to force password change" read user; chage -M 7 $user; How can I do it by modifying /etc/shadow?? (6 Replies)
Discussion started by: tjay83
6 Replies

6. Shell Programming and Scripting

force to change password(shell script)

hi How can I force user to change of password by modifying the password expiry and the grace period so that the user has at least 1 week to login and change the password...... (3 Replies)
Discussion started by: tjay83
3 Replies

7. AIX

Can't login root account due to can't find root shell

Hi, yesterday, I changed root's shell in /etc/passwd, cause a mistake then I can not log in root account (can't find correct shell). I attempted to log in single-mode, however, it prompted for single-mode's password then I type root's password but still can not log in. I'm using AIX 5L version 5.2... (2 Replies)
Discussion started by: neikel
2 Replies

8. Answers to Frequently Asked Questions

Lost root password / Can't login as root

We have quite a few threads about this subject. I have collected some of them and arranged them by the OS which is primarily discussed in the thread. That is because the exact procedure depends on the OS involved. What's more, since you often need to interact with the boot process, the... (0 Replies)
Discussion started by: Perderabo
0 Replies

9. UNIX for Advanced & Expert Users

Force to change to a different password

Hi, I notice in my Sun Solaris 8 sparc worstation, I am able to change my password to same existing password. That is, right now my password is abc, and I change it with "passwd" command and change it abc again. It will accept. How can I make it such that it will not accept same password?... (3 Replies)
Discussion started by: champion
3 Replies

10. UNIX for Advanced & Expert Users

Force Password Change...RedHat 7.1

Hello, I just finished adding a bunch of new users to the linux servers I administer. I add users either via command line or via linuxconf, but I can't seem to find out how to force users to change their passwords on their first login to the system. Anyone know how to do that? My HP-UX... (1 Reply)
Discussion started by: vancouver_joe
1 Replies
Login or Register to Ask a Question