HP-UX

The root pwd on an hpux11i box was changed by an ex-employee. Is there anyway to reset it without shutting down the machine? If not how can I do it..

Thanks in Advance
Brian

The procedure is risky and may damage the system from a software standpoint. It should be done by an expert. In the worst case you will need to re-install the OS and relad your backup tapes.

Sign on as an ordinary user and type "sync". Syncer should be runining anyway, so this may not help much, but it's easy to do and it might help. Wait about one minute or so.

Turn off the system.

Turn it back on.

Interupt the boot process and boot into single user mode. The exact details of this vary from model to model. But basicly you boot from the primary path. And you want to interact with ISL. Once you have that ISL prompt, type "hpux -is".

This should bring the box to single user mode. If the rough shutdown damaged the filesystem too much, you may be in trouble. This is where a lot of expertise comes in handy....

Run "fsck -y" and hope that it can fix the filesystems. This can take a while.

Now run the passwd command or edit /etc/passwd. You may need to mount /usr and /var depending on how your disk is configured and what commands you use.

Unmount anything you mounted.
reboot.

This almost always works. HP-UX is rather robust. But you might want to contact the ex-employee to get the password. After all, he or she will need a good reference, so you should be able to get it.

Read these man pages...

man pdc
man isl
man hpux

Try this, might help.

Logon on the system as root by either ssh or su
and reset the root passwd as
#/usr/lbin/modprpw -k root
#/usr/lbin/modprpw -x root

Now try to logon console using new root password

This will work.....

Hi,

just for convenience:

Turn on your box
Hold on the Escape key until a menu appears.
Type 'boot pri isl'
When the ISL> prompt appears type:
hpux -is
(if you have HP-UX 9.x type: hpux -is boot)
The system is now booting in single user mode.
When you get the root shell prompt (#) type:
passwd root
The system asks you twice for the new root's password.
If you have done type:
reboot
Now your box reboots and comes normally up and you can login as root with your previous changed password.

Your question is essentially how can you act as root without knowing root's password - that's the only way you can change root's password without being logged in as root or having su privileges (which I assume you do not).

The answer is that there is no legitimate way to do that. Unix security is designed to prevent that from happening.

It may be that you could identify an exploit on your computer which would allow you to gain root privileges from a non-root account. But in doing so you run the risk of damaging either the run state or file system of your computer. Many hacks are detected because they break something on the computer.

To avoid a situation like this in the future you could create an administrative account with a UID of 0 on your computers and have a manager keep the password locked away. The risk with these types of accounts is that since no one normally uses them, if they get compromised it is unlikely you'll notice until something else breaks. But they do give you an alternative path into the computer.

I suspect that you're out of luck this time. As the other posters point out, you'll have to boot into single user mode to fix this.

HP-UX is robust but it has flaws...


While that is true, our rules state:

These are not hacker boards so hacker related posts will be promptly deleted or moderated.

-- Perderabo

1. Recycle power: either use reboot or hard-boot
2. Interrupt boot sequence by pressing "ESC"
3. When prompt IPL, choose "YES"
4. Type the single-user mode boot command: hpux -is
5. After entering single-user mode, use passwd command to change password
6. Reboot to multi-user mode
7. Done