AIX

AIX

Connect with fellow AIX users and experts to gain knowledge, share insights, and solve problems.


#Power
#Power
 View Only
Expand all | Collapse all

Displays password change warning for root user

  • 1.  Displays password change warning for root user

    Posted Wed June 21, 2023 12:31 PM

    Hi,

    How do I add a warning before changing the password for the root user?

    I have been trying to find a solution to this problem for a long time, but nothing comes to mind.
    Adding a warning to /etc/motd does not solve the problem.

    That is, we type:

    passwd root

    the message appears
    "This operation can cause major issues..."

    Help me 



    ------------------------------
    Marcin Marciszewicz
    ------------------------------


  • 2.  RE: Displays password change warning for root user

    Posted Thu June 22, 2023 01:03 AM

    HI... I'm not sure, but I think your system may have been hijacked... since then, I've never seen that message before...

    I mean that someone may have changed something in the system without your authorization, such as:

     

    1. a) The root user's default PATH variable has been changed to something that allows it to find executables in another directory before the usual /usr/bin or /usr/sbin and there is another passwd file that shows it a message instead of allowing it to change the password. Review if PATH variable includes other directories or even "." directory for root user.
    2. Maybe the /usr/sbin/passwd (which is the AIX's bin file to change the password) has been replaced for another file (like a shell script or another bin). Check if the file type of /usr/bin/passwd is an executable and if it CRC has not changed.

     

    If you need to change the passwd you could find an original file of passwd command and execute it with the absolute call... i.e "/another_directory/passwd root"...

    Maybe you could need to copy it from another server (with the same OS level) or from a backup or rootvg (mksysb).

     

    Other way, if it is available, is to have another user with security role and change password of root. Maybe, its environment hasn't been changed and be immune to the hijack I think could have.


    Another uncommon way to change the password of root without having the passwd file command available, is modify the file of /etc/security/passwd and alter or change the row with the encrypted root's passwd with another encrypted password from another server with AIX with the same system password algorithm like sasha256 (for example) as it is shown in /etc/security/login.cfg file in pwd_algorithm attribute.

    (This is not a regular procedure and you will be taking risks doing so, take some precautions like save the old encrypted password, save a copy of /etc/security/passwd and keep a console terminal open to revert changes if something is wrong)

     

    Regards

     

    Luis Rojas

     






  • 3.  RE: Displays password change warning for root user

    Posted Thu June 22, 2023 11:38 AM
    Oops.. Sorry...  I think I misunderstood your question...

    Luis Rojas





  • 4.  RE: Displays password change warning for root user

    Posted Thu June 22, 2023 10:29 AM

    You can add a wrapper script as below and name it passwd and keep it in a directory that is in first search order in PATH variable.

    ====================================================================

    if [ ${1} == "root" ];then
      echo "This operation can cause major issues..."
      echo "Press Enter to continue changing ${1} password"
      read hold
      passwd ${1}
    else
      passwd ${1}
    fi

    =============================================================================

    This will give you the expected results I believe.



    ------------------------------
    Fazel Vayalilagathu
    ------------------------------



  • 5.  RE: Displays password change warning for root user

    Posted Thu June 22, 2023 11:14 AM

    Hi,

    I will try to check this solution next week

    Thanks a lot



    ------------------------------
    Marcin Marciszewicz
    ------------------------------



  • 6.  RE: Displays password change warning for root user

    Posted Wed June 28, 2023 09:05 AM

    Hi Marcin,

    You could define a function that calls the actual password command.

    Regards,

    Henrik Morsing



    ------------------------------
    Henrik Morsing
    ------------------------------



  • 7.  RE: Displays password change warning for root user

    Posted Wed July 12, 2023 07:38 AM

    Hello,

    In general, I created the script thanks to your help :)

    I have implemented the command passwd and passwd $USER, then check whether the user belongs to the correct group and whether the logged in user is root.

    #!/bin/ksh
    USER="`/usr/bin/whoami | awk '{print $1}'`"
    SGROUP="`id -gn ${USER}`"

    if [[ ${1} == "" ]];then
        if [[ $SGROUP=="system" ]] && [[ $USER=="root" ]];then
        echo "#####################################################################
            #                                                                   #
            #              This operation can cause serious problems.           #
            #      Changing the root password may result in a problem with the  #
            #                   operation of the client application             #
            #                                                                   #
            #####################################################################
            Press Enter to continue changing `whoami` password"
        read hold
        /usr/bin/passwd
        fi
    elif [[ ${1} == "root" ]];then
        if [[ $SGROUP=="system" ]] && [[ $USER=="root" ]];then
        echo "#####################################################################
            #                                                                   #
            #              This operation can cause serious problems.           #
            #      Changing the root password may result in a problem with the  #
            #                   operation of the client application             #
            #                                                                   #
            #####################################################################
        TEST Press Enter to continue changing `whoami` password"
        read hold
        /usr/bin/passwd ${1}
        fi
    fi

    I added to the .profile of the root user the path to the script

    I assigned run permissions and everything works as I expected. 

    Is there any way to optimize it better?

    Thank you all for the tips.



    ------------------------------
    Marcin Marciszewicz
    ------------------------------



  • 8.  RE: Displays password change warning for root user

    Posted Sun July 16, 2023 08:34 PM

    Hi Marcin

    A few points to consider:

    1. /.profile is not executed when a non-root user runs "su". Only "su -"

    2. the syntax of the passwd command is:

    passwd [ -R load_module ] [  -f  |   -s  -a ] [ User ]

    i.e. the user name may not always be $1



    ------------------------------
    Chris Wickremasinghe
    IBM
    ------------------------------



  • 9.  RE: Displays password change warning for root user

    Posted Fri July 21, 2023 09:13 AM

     Hi, I'm trying to use your script but has an error about syntax: 0403-057 Syntax error at line 5 : `then' is not expected.

    Can you help me about it. Thank you 



    ------------------------------
    Dao Tien Dat
    ------------------------------



  • 10.  RE: Displays password change warning for root user

    Posted Wed September 06, 2023 10:58 AM

    Try this, I removed the brackets [ ], and added spaces behind when comparing:


    #!/bin/ksh
    USER="`/usr/bin/whoami | awk '{print $1}'`"
    SGROUP="`id -gn ${USER}`"

    if [[ ${1} == "" ]];then
        if [ $SGROUP == "system" ] && [ $USER == "root" ];then
        echo "#####################################################################
    #                                                                   #
    #              This operation can cause serious problems.           #
    #      Changing the root password may result in a problem with the  #
    #                   operation of the client application             #
    #                                                                   #
    #####################################################################
            1.Press Enter to continue changing `whoami` password"
        read hold
        /usr/bin/passwd
        fi
    elif [[ ${1} == "root" ]];then
        if [ $SGROUP == "system" ] && [ $USER == "root" ];then
        echo "#####################################################################
    #                                                                   #
    #              This operation can cause serious problems.           #
    #      Changing the root password may result in a problem with the  #
    #                   operation of the client application             #
    #                                                                   #
    #####################################################################
            2.Press Enter to continue changing `whoami` password"
        read hold
        /usr/bin/passwd ${1}
        fi
    fi



    ------------------------------
    Marcin Marciszewicz
    ------------------------------



  • 11.  RE: Displays password change warning for root user

    Posted Thu September 07, 2023 11:19 AM
    When checking for none existent / null values I usually write the if statement with quotes around the variable.  This deals with the situation where there is no value for the argument.  If the value is null, after argument resolution, the if statement becomes:

    if [[ == ""]] ....

    which is an invalid statement.

    Ex.  if [[ "${1}"  == "" ]] ........

    JimR






  • 12.  RE: Displays password change warning for root user

    Posted Mon July 24, 2023 06:15 AM

    Why is changing the root password an issue ?



    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------