When root is locked out of a system, it can be a real problem. It’s even worse when you are root, yes?
There are many legitimate reasons this can happen:
- You purchased a used system with operating system installed, and the root login is unknown.
- The root password expired. (This has happened!)
- You have taken on a new system as a system administrator, and no one knows what the root password is (or what the box is, or what it does…)
- You have taken on a job as a new system administrator, and the previous administrator didn’t leave all of the passwords.
- You just plain forgot the system password (uhoh…).
We are going to assume that single user mode is locked out or not available. We are also going to skip talking about taking the system down (which is going to be necessary in any case). We are also going to assume that you have legitimate physical access to the system.
In most situations, the system admin’s adage holds true: if you have physical access to the box, then there’s no stopping you from breaking in. That’s why many operating systems make it fairly easy to access the system with physical access - and this is the reason you must physically secure your servers. Putting them behind locked doors is the easiest and best way to go. With physical access, it generally becomes easy to get into the system.
If you can access single user mode (such as booting HP-UX with “hpux -is” or booting Linux with “linux single“) then you can do all of the password recovery steps quite easily.
No matter what the operating system, if you have physical access to the system itself, then it is generally possible to crack it. There is a method that will work with any system:
- Convert the disk into a “secondary” data disk in some fashion.
- Boot into another operating system that can read and write the now secondary data disk.
There are several ways to do this. One way is to use a bootable floppy, CDROM, or DVDROM to enter into a maintenance mode, then access the original boot disk in the system. Sun Solaris has this capability using the install disk, as does Red Hat Enterprise and OpenSUSE. There are also bootable floppies and CDROMs that run on Linux all over everywhere.
Another way is to physically extract the hard disk from the system, and to use it as a data disk on another (identical) system. Macintosh laptops have this capability “builtin”: it’s called Target Mode, and turns the laptop into a large disk on a Firewire connection to a desktop or other system.
Remember, however, that the Macintosh uses NetInfo to manage its data; you’ll probably have to manipulate the NetInfo database on the other system in some fashion, or at least, turn it off. That’s currently beyond our knowledge (but who knows…).
Under HP-UX, the boot disk is probably a single volume group, vg00: this volume group would have to be vgexported and vgimported in some fashion. The LVM structures would have to be accounted for.
Once the once bootable system is correctly mounted (read and write) as a data disk on another system, the easiest thing to do (with UNIX and Linux) is to change root’s password to null, by making the password entry empty in the /etc/password file. With NT, you may be able to extract the SAM file and use a cracker like L0pht to reveal the password.
With OpenVMS, the steps are more complicated, but the concept is the same: use a different security environment (an alternate UAF) and change the password in the original environment (the original UAF). First, alter the booting process to make OpenVMS boot into a sysboot> prompt. At this prompt, enter the command to use an alternate UAF:
sysboot> set uafalternate 1
sysboot> continue
The username and password to login will be null, so login by pressing enter until the prompt appears. Then we need to go about changing the password entry for SYSTEM:
$ define/system/executive sysuaf sys$system:sysuaf.dat
$ set def sys$system
$ run authorize
Authorize> modify system/password=newpass/nopwdexp
Authorize> exit
Then restore the alternate UAF setting back to zero so that the system UAF will be used on reboot:
$ run sys$system:sysman
sysman> param use current
sysman> param set uafalternate 0
sysman> param write current
sysman> exit
Then reboot the system and the SYSTEM password should be newpass.
This sequence hints at one reason a root password might “go bad” - if your root password expires, then you are undone. These steps still work, but instead of changing the password, one will have to reset the expired account so you can login again.
