Solaris and Lost Root Password HP−UX and Lost Root Password

Chapter 28: UNIX Emergency Situations

28.1 Introductory Notes

UNIX systems run and behave very stably, especially if they are properly configured for their missions. Unfortunately, unpredicted and unwanted situations occur. A UNIX system, as any other computer system, can experience different problems giving quite a hard time to UNIX administrators. It is very important to be ready to handle such events. This chapter describes several procedures to overcome certain emergency situations. It is very instructive in the sense of what to do if something similar happens. Although the illustrated examples are related to Solaris and HP−UX flavors, they could also provide hints on how to approach the same problems on other UNIX platforms. In the first part, the problem of forgotten root password is addressed; more or less every UNIX administrator faces the same problem during the professional carrier. The second part describes some other cases when a recovery action is required, or at least preparedness for such an action is supposed. All presented examples are fully documented.

28.2 Lost Root Password

Almost all UNIX administrators during their professional careers face the problem of a lost root password; occasionally a root password for some of the existing UNIX systems drops out of our control, and we are no longer able to administer that system. In a network with several hundred UNIX boxes, administered by dozens of UNIX administrators, it is not so unusual to find a forgotten system that nobody has taken care of lately. How it happened, and why it has happened, is another issue; the fact is that a superuser access to this very system is not possible, and we desperately need it. UNIX predicts such situations, and each UNIX flavor does have a procedure to solve them. The forgotten password can never be recreated — it can only be replaced with a new password. However, UNIX allows the change of a password only if the old password is previously submitted as a proof of an authorized password replacement. Obviously, at the moment we are not able to fulfill this requirement. So the solution is to purge the encrypted root password in the etcpasswd file or etcshadow file, where encrypted passwords are normally kept. For this action the UNIX system has to be brought in the single−user mode. Two examples follow.

28.2.1 Solaris and Lost Root Password

This paragraph describes the emergency procedure to change the root password on Solaris 2.X platform if the root password was lost forgotten. When root access to the system is not possible, the usual procedures to change a password by using the command passwd, or to bring the system into single−user mode cannot be implemented. The emergency procedure requires the Solaris 2.X OS Installation CD disk. Start Solaris 2.X from CD in single−user mode. Put Solaris 2.6 Software CD in the CD drive. ok boot cdrom −s At this point the Mini OS — single−user mode — from CD is loaded into memory. 1. 692 mount devdskc0t3d0s0 a this is an example — here the corresponding device file for the root partition must be used Set a terminal for easy editing: TERM = vt100 export TERM 3. Purge encrypted root password from shadow file: cd aetc vi shadow delete encrypted password from the root password entry — leave the field blank At this point, the old lost root password is removed and the root access to the system is possible; there is no password at all, and the system should be disconnected from the network to prevent potential intruders. 4. Reboot the system: reboot 5. Setchange the root password: passwd ..... ..... 6. This step may be used if there is some booting problem with the boot disk. Upon booting to single−user mode from CD, run fsck on the root partition. fsck devrdskc0t3d0s0 use the corresponding device file for the root partition 7.

28.2.2 HP−UX and Lost Root Password

To change a lost forgotten root password, the system must be brought into the single−user mode. Since a system reboot requires the root password, the only possible way is to power−off the system a system halt also requires the root password, with an unavoidable risk for a filesystem corruption. Once it is down, the procedure is: Power−on the system. 1. Follow messages on the console. Pay attention to the message: 2. 693 At main menu prompt enter: Main Menu: Enter command or menu boot Respond to the question: Interact with IPL Y or N? y booting… At ISL prompt enter: ISL hpux −is 3. The system continues booting and enters the SINGLE USER mode. Purge the encrypted root password from etcshadow file. 4. Reboot the system into the multi−user mode: shutdown −r 0 5. Change the root password: passwd ..... ..... 6.

28.3 Some Special Administrative Situations