I work with a Solaris Sun Server V240 system (GCCS) and have run into a problem where I can't seem to unlock my SECMAN account at the NON-GLOBAL level. I have access to all global accounts to include sysadmin and secman. I have access to the non-global sysadmin account and root (SU) throughout.
To date, I have tried to use the PASSWD command to reset the SECMAN password at both the global (using zlogin to get to the non-global level) and just logging in as sysadmin in the non-global level and working through a terminal window as SU to reset the password there. In ALL cases, even though the password reset implies it was successful, I am unable to log in as SECMAN in the non-global level using the new password.
Is there a way to create a new secman account in the terminal window within the non-global zone? Any help with this issue is greatly appreciated.
Robin, Hicksd8, many thanks for the replies. I have managed to solve my issue but first to your questions. Unfortunately for me, since I’m working on a classified system, I can’t print or transfer any data from their to here easily. I could transpose the unclassified portions manually but that will no longer be necessary.
There are no login time restrictions in place.
I’m using Solaris 10.1 and the system is Global Command and Control.
Here is what I was able to do:
Log on to the non-global zone as Sysadmin via zlogin in a terminal window, log in as su and run the APM client via /h/COE/Comms/APM/APM_Client (or very close to that). Once it was up, I had full control of all accounts again and was able to update the seaman password. Note that it did NOT apply the change to any of the other non-global zones as would be the norm. So that required me to log out fully, log back into secman via the non-global zone and change the password to a throwaway password. Log out, log back in and change it yet again but this time is synced up with the other non-global zones.
There is another way to do this via the terminal window and some creative su logins but I have to get my notes to make sure I post the correct login sequence.
That said, I’m sure it is clear to you that I am no unix expert. I have a ton of experience working as a GCCS operator but only a little as a sysadmin. I am learning as I go and would like to pick your brains as I learn. I have also imaged everything (controllers, servers, workstations) so backups are in place. More to follow and thank you again.
Good day. I have setup hardening the password (test system so far) prior to doing any work on production. Here is what I have set.
Snippet from /etc/pam.d/system-auth
auth required /lib/security/$ISA/pam_env.so
auth required /lib/security/$ISA/pam_tally.so... (3 Replies)
having account lockout issues with an RHEL 5 server. My users are getting locked out for 10 minutes after one failed login attempt even though /etc/pam.d/sshd is configured for 5 failed attempts:
auth include system-auth
auth required pam_tally2.so deny=5 onerr=fail... (1 Reply)
On a redhat linux 4 server, how to find if there is an account lockout duration is set. Is it configured under pam or /etc/shadow? what entries I need to find out? Is it pam_time.so module?
I desperately need an answer because on one of the servers, no one was able to login through any account... (4 Replies)
What is the best way to implement account lockout in openldap? I have an openldap server with Ubuntu desktop client connecting to it for authentication. I want he accounts to locked out after say 5 failed authentication attempts
I have enabled ppolicy layout in slapd.conf.
overlay ppolicy... (0 Replies)
Hi all;
I m using Red Hat Enterprise Linux Server release 5.1 (Tikanga) and I'm trying to setup password lockout policy so that a user account locks out after 3 failed attempts.
Here are the entires of my /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes... (1 Reply)
I want to know if there is any easy way of stopping 1 user from using su? perferabily any su but I can make do with not allow him to su to root but allow other user to su to root. (3 Replies)
Hi,
We are using 4.3.3.0 and I would like to make a global change to the "number of failed logins before user account is locked"
Any ideas, other than using SMIT one user at a time.... ???
Thanks... Craig. (2 Replies)
Hi, I am extremely new to UNIX and was recently promoted to administer the system for a small company. Anyhow, the time came for passwords to change, and I made the huge mistake of entering in the command (as root)
passwd -l
After logging out (oblivious to what would happen next), the root... (4 Replies)
I am using AIx 4.3.3 and was wondering what the command was to keep users from logging in. I want to be able to do maintenance and keep the users out. Can anyone help? (7 Replies)
