HPUX root account keeps getting disabled

[meha...@gmail.com]

Hi,

I have HPUX box whose root account gets disabled very often. What could

be the reason?

The password aging is set to 120 days.
Number of unsuccessful tries, which is set to the default 3. I am the
only user and I never attempted wrong password.

Thanks in advance,
Mehaboob

[Michael Paoli]

meha...@gmail.com wrote:
> I have HPUX box whose root account gets disabled very often. What could
> be the reason?
> The password aging is set to 120 days.
> Number of unsuccessful tries, which is set to the default 3. I am the
> only user and I never attempted wrong password.

Perhaps someone or something else is attempting to login as root, and
triggering the lockout. You don't mention which version of HP-UX.

What does:
# /usr/lbin/getprpw root
show you (presuming that's applicable for your HP-UX version), most
notably for "lockout"? What about:
# lastb root

references:
getprpw(1m)
last(1)
http://docs.hp.com/en/B2355-90691/getprpw.1M.html
http://docs.hp.com/en/B2355-90689/last.1.html

[Casper H.S. Dik]

"Michael Paoli" <micha...@yahoo.com> writes:

>meha...@gmail.com wrote:
>> I have HPUX box whose root account gets disabled very often. What could
>> be the reason?
>> The password aging is set to 120 days.
>> Number of unsuccessful tries, which is set to the default 3. I am the
>> only user and I never attempted wrong password.

>Perhaps someone or something else is attempting to login as root, and
>triggering the lockout. You don't mention which version of HP-UX.

>What does:
># /usr/lbin/getprpw root
>show you (presuming that's applicable for your HP-UX version), most
>notably for "lockout"? What about:
># lastb root

Wild guess: you employ some form of X locking and the X locking you use
has a form of "allow root password to unlock any display".

It may then attempt an root password use on each unlock operation (including
hitting return when the screen is locked?)

Casper
--
Expressed in this posting are my opinions. They are in no way related
to opinions held by my employer, Sun Microsystems.
Statements on Sun products included here are not gospel and may
be fiction rather than truth.

[meha...@gmail.com]

On 23 Jan, 17:56, Casper H.S. Dik <Casper....@Sun.COM> wrote:
> "Michael Paoli" <michael1...@yahoo.com> writes:

> >mehab...@gmail.com wrote:
> >> I have HPUX box whose root account gets disabled very often. What could
> >> be the reason?
> >> The password aging is set to 120 days.
> >> Number of unsuccessful tries, which is set to the default 3. I am the
> >> only user and I never attempted wrong password.
> >Perhaps someone or something else is attempting to login as root, and
> >triggering the lockout. You don't mention which version of HP-UX.
> >What does:
> ># /usr/lbin/getprpw root
> >show you (presuming that's applicable for your HP-UX version), most
> >notably for "lockout"? What about:

> ># lastb rootWild guess: you employ some form of X locking and the X locking you use

> has a form of "allow root password to unlock any display".
>
> It may then attempt an root password use on each unlock operation (including
> hitting return when the screen is locked?)
>
> Casper
> --
> Expressed in this posting are my opinions. They are in no way related
> to opinions held by my employer, Sun Microsystems.
> Statements on Sun products included here are not gospel and may
> be fiction rather than truth.

Hi,

Below is the detail,

HP-UX version B.11.23 U ia64

lastb command does not show any repeated unsuccessful attempts
recently.
# lastb root | head
oot pts/tb Tue Jan 23 04:54
root pts/tb Mon Jan 22 05:36
root pts/tb Fri Jan 19 04:34
root pts/ta Wed Jan 10 05:49
root pts/tc Mon Jan 8 06:34
root pts/tc Fri Dec 22 06:10
root pts/tc Tue Dec 5 18:09
root pts/tb Tue Oct 10 13:36
root pts/tb Mon Sep 18 20:54
root 16.27.194.11 Sat Sep 9 20:44

# /usr/lbin/getprpw root
uid=0, bootpw=YES, audid=0, audflg=1, mintm=0, maxpwln=-1, exptm=0,
lftm=0, spwchg=Tue Jan 9 15:42:40 2007, upwchg=Mon Jan 8 06:17:23
2007, acctexp=-1, llog=-1, expwarn=0, usrpick=DFT, syspnpw=DFT,
rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT,
timeod=-1, slogint=Mon Jan 29 13:16:19 2007, ulogint=Sun Jan 28
16:43:55 2007, sloginy=pts/tb, culogin=-1, uloginy=-1, umaxlntr=-1,
alock=NO, lockout=0000000

I am still facing the problem. Do let me know.

Mehaboob