Out auditors want me to set failedlogins for root which I am OK with, but I
cannot figure out what rights I have to give to myself so I can reset the
failedlogin counter should the account get locked. Need a little help.
Thanks!

Tim

Tim Porreca wrote:
> Out auditors want me to set failedlogins for root which I am OK with, but I
> cannot figure out what rights I have to give to myself so I can reset the
> failedlogin counter should the account get locked. Need a little help.
> Thanks!

You probably shouldn't be using the failedlogin counter on root. If
your auditors suggested it, they're exceptionally stupid for an auditor.

Disable remote root login and lock it to the console for emergency/
update use.

Everyone should log in as their own ID and "su" to root.

This provides an audit trail... something an auditor should find "good"

Easy.... This is a VERY stupid idea.

chuser loginretries=2 rlogin=false root

As a "backdoor"... configure sudo (very easy)
http://www-03.ibm.com/servers/aix/pr.../download.html

Assign yourself (and admin team) to a group and assign that group to a
group which can execute /usr/bin/ksh.

Then you can "sudo /usr/bin/ksh"... input your password and get a
"root" shell. From there, you will be able to reset root if someone
locks root out.

Good Luck,

Chris Young
Gun for Hire
614-804-8649