su not asking for password

[beardyboy]

The the 8/9 users on the machine from the $ prompt can type su and be logged straight in as root without being asked for the password (a password is set). I would presume theres been an option changed in smit to allow users to do this? If so which is it so I can change it back.


Thanks in Advance

 

[hallux]

I don't know if there is an option for su, I don't have root access to an AIX box right now. But I would check the following.

1) When the users run "su", is it running the su binary that you want them to run.
Try this code as the user to check the location:
$ whereis su
su: /usr/bin/su
Be aware that a script may be named "su" and be the one executed instead of the /usr/bin/su binary.

2) There is also a package called sudo, check to see if you have it installed, it may be logging folks in w/o passwords.

3) Are the users sharing the id for root. Logged in as one of the user type "id" to see if the uid = 0. You can also check their id without logging in as them (e.g.: id username). If they share an id with root (0), they are root.

Good Luck.
-Hallux

 

[Robnhood]

I would check a couple of other thinks too.

Check to see how the users are set up in /etc/passwd.

I would also check to see if the root user has a password.

Craig

http://www.SecurelySpeaking.com

 

[petertp6]

check your /etc/passwd
1.Does "!" in first line for root is gone?
it should be this
v
root:!:0:0::/:/bin/ksh
^
UID
2.Do you find any user's UID is 0?

Root cause of your problem is one or both of them.
in 1. insert a ! to place it should be.
in 2. lock this user (replace ! by * ) and check out who did it. After you figure out what happen, change UID to the user should be.

 

[beardyboy]

After I posted here I got him to check /etc/security/passwd:

The stanza in /etc/security/passwd is as follows

root:
password =
flags =
lastupdate = 1062834442


So basically one of his operators removed the password accidently (fiddling) and probably didn't want to own up. Password has been reset although it wouldn't set via command line they had to use smit.