NetApp Root Account Login History

Hi All,
Is there a command I can input into my 7-mode filer's CLI to interrogate / display the root account login history, when the root username & password have been used to to access the filer's CLI.
Apparrently, the filer root account has never been used to access the filer since initial config.
I'd appreciate any suggestions
Tks In Advamce
C.J.

Hi Yishikawa, Thanks very much for the /etc/log/auditlog tip. I ran the above command you suggested on the NetApp site and found the following NetApp library link entitled "Understanding Audit Logging" https://library.netapp.com/ecmdocs/ECMP1368862/html/GUID-B6117506-C89B-4463-A2DF-29BFAC99A72F.html In the above link, it is suggested that the filer saves audit-log files for six weeks, (unless any audit-log file reaches the maximum size) after which the oldest audit-log file is discarded. I suspect any of the root account logon attempts I wanted to track will already have been deleted. I don't suppose there's any system shell commands that could accomplish the same aim? Thanks for your response C.J.(aka Millsy64)

Similar Messages

How to allow users to launch SMC; login to SMC without root account

I've very familliar with how to create accounts and assign members to groups and assign privliges in Solairs 10 using SMC. I want a user to review the audit logs using the SMC console since the logs are GUI but I don't want the user to use the root account to login to SMC. I know the user can use the su command but I can only login with root after typing su and then launch SMC.
Bottom line what is the best way a user can use the SMC console without having the root password to execute SMC and then login to SMC and view the audit logs?
A million thanks
John

I found the best solution is to use a Role Based Access Control (RBAC). Using SMC as root go the the Role Icon and setup a Role using the wizzard. Next have the user login to the system, go to the terminal and type:
/usr/sadm/bin/smc &
The individual user will be prompted to login with his specific user name and password and then prompted to use the Role Login Name and Password you provided in the above paragraph.
Now the user can perform SMC functions without the need for root.

Root account locked out after 3 login attempts

I've connected to a 280R (Solaris 9) machine through the console (null modem cable). After trying 3 failed login attempts, it reported that the root account has been locked out. When can I do now to re-enable it?
Vincent

The usual dance. :-)
1. Put in a Solaris install CD
2. "boot -s " at the "ok" prompt.
3. mount /dev/c<your boot partition> /mnt
4. edit /mnt/etc/passwd
5. Reboot the system.
6. login as root
7. Set your password.
8. write it on a post-it.
9. place post-it on monitor.
I'm kidding with steps 8 and 9.
HTH,
Roger S.
PS - Happy T-day

I am trying to activate root account on my MAC. The directions I've seen do not match what is in System Preference for Accounts or Users

I am trying to activate the root account on my new Mac Book Pro. The instructions that I have found do not match what I have in System Preferences. What is the process when using Users and Groups. When I click on Join the Network Account Server- Open Directory Utility I don't see a option to activate root user as the instructions say at http://support.apple.com/kb/HT1528
OS X Lion
From the Apple menu choose System Preferences....
From the View menu choose Users & Groups.
Click the lock and authenticate as an administrator account.
Click Login Options....
Click the "Edit..." or "Join..." button at the bottom right.
Click the "Open Directory Utility..." button.
Click the lock in the Directory Utility window.
Enter an administrator account name and password, then click OK.
Choose Enable Root User from the Edit menu.
Enter the root password you wish to use in both the Password and Verify fields, then click OK.

Do you mean you cannot select "Enable Root User" from the "Edit" menu as shown below?
Why do you think you need to enable the root user? I've never needed it in the history of OS X.

How can I transfer the root account on my computer to a regular account?

Not sure if this in the correct category, but anyway...
Back in October 2010, I installed a Java update or something on my regular account, and it broke the account for some reason. I had no other account to use except for the root user that I enabled previously (just for testing). I logged into it and used it as my regular account, checking every so often to check if my regular account fixed itself. Sadly, it didn’t (at the time), but after a while, I upgraded my computer to Snow Leopard (I was previously running Leopard), I found that my old account finally fixed itself. Immediately, I attempted to copy over all of my files from the root account to the other account. I went onto the account, and it seemed to be a fresh account, so I assumed that it didn’t register the account files as legitimate and I guess it made it into a new account. I gave up after fiddling with it for a bit. To this day, I’m still using the root user as my main account, but a lot of things are broken (like Spotlight, Mail search, some other things) and I’d just like to know a clean way I could easily transfer all of the stuff from the root user to my old account (including all of the Library files and such). Please don’t say “You shouldn’t have used the root user because it’s really dangerous,” or whatever. I’ve been responsible with it for almost 2 years and I don’t think I could’ve done anything else. Thanks for any help.

Its doable with Terminal. Log into your new userfolder in the /Users/ folder and open Terminal and say:
whoami
This is the owner of your newly transferred files.
Log into your root account and Launch Terminal. You will use the scp (secure copy) command to copy your files over to the new userfolder, replacing PathToNewFolder with the path to your new folder:
cd /PathToNewFolder
scp -r /private/var/root/* .
The copied files will all have ownership of root account, so you will then set ownership of all the files to your new username that you remember from above, replacing "NewName" with your new username:
$USER=NewName
find . -exec chown $USER:admin {} \;
find . -type d -exec chmod 750 {} \;
find . -type f -exec chmod 640 {} \;
chmod 755 Library
find Library -type d -exec chmod 755 {} \;
find Library -type f -exec chmod 600 {} \;
chmod 755 Library/Autosave\ Information Library/Application\ Support Library/Keychains Library/Application\ Support/Terminal
chmod 644 Library/Preferences/QuickTime\ Preferences Library/Keychains/* Library/Favorites/* Library/Caches/com.apple.preferencepanes.cache Library/Caches/com.apple.preferencepanes.searchindexcache
chmod 755 Public ~/Sites
chmod 733 Public/Drop\ Box
find Sites -type d -exec chmod 755 {} \;
find Sites -type f -exec chmod 644 {} \;
Then you can login to your new account with all your stuff hopefully intact. If anything doesn't work respond here and it can be fixed.

Can't set password for Root account

I have rebuilt my macbook from scratch not from a backup , I then opened Terminal and typed sudo passwd root (got the message) entered a password, I got Sorry try again. tryed again same thing, I definately reinstalled from scratch therefore my root password should have been empty. How do I set my root password???? Thank you

I got it - Apple Menu- System preferences-Accounts - Login Option - Join -Open Directory Utility ...- Edit (menu)
enable root password

[SOLVED] Mouse Acting Up When Using Cinnamon In Non-Root Accounts

I have recently installed Arch linux on my computer, alongside Ubuntu and Windows. I installed cinnamon and xorg from the official repositories, and was happy with the experience. However, I wanted to transition from a root account to a normal user account, because certain software (e.g. Chrome) refuses to run under root. So, I created my user, home directory, and password, and was able to login. I copied my .xinitrc from my root home directory to my normal user accounts' home directory. The contents were this:
exec gnome-session-cinnamon
So, I type startx on the command line, expect everything to work normally, and I find that my mouse is not working properly:
1. I am unable to drag windows around
2. Applications with a scroll bar automatically scroll down to the bottom of page, and you can't scroll back up again
3. I cannot click anything on the sidebar of the cinnamon menu (which contains things like logoff and shutdown, so I had to kill the x server)
However, when logged in on root, none of this happens. At first, I thought this problem was due to me using a display manager (I used gdm and slim). This, however, is not the case. There isn't much out there on the internet for the problem I have, and I assume that this doesn't happen very often. What I did find, however, was to install the following packages:
sudo pacman -S xf86-input-evdev
sudo pacman -S xf86-input-mouse
The problem was still not fixed. I do not have an xorg.conf, but I do have a 50-vmmouse.conf in /etc/X11/xorg.conf.d (I don't know if that's helpful, though):
Section "InputClass"
Identifier "vmmouse"
MatchIsPointer "on"
MatchTag "vmmouse"
Driver "vmmouse"
EndSection
Edit: I have a (I think) slightly more useful file: 10-evdev.conf in the same directory:
# Catch-all evdev loader for udev-based systems
# We don't simply match on any device since that also adds accelerometers
# and other devices that we don't really want to use. The list below
# matches everything but joysticks.
Section "InputClass"
Identifier "evdev pointer catchall"
MatchIsPointer "on"
MatchDevicePath "/dev/input/event*"
Driver "evdev"
EndSection
Section "InputClass"
Identifier "evdev keyboard catchall"
MatchIsKeyboard "on"
MatchDevicePath "/dev/input/event*"
Driver "evdev"
EndSection
Section "InputClass"
Identifier "evdev touchpad catchall"
MatchIsTouchpad "on"
MatchDevicePath "/dev/input/event*"
Driver "evdev"
EndSection
Section "InputClass"
Identifier "evdev tablet catchall"
MatchIsTablet "on"
MatchDevicePath "/dev/input/event*"
Driver "evdev"
EndSection
Section "InputClass"
Identifier "evdev touchscreen catchall"
MatchIsTouchscreen "on"
MatchDevicePath "/dev/input/event*"
Driver "evdev"
EndSection
Last edited by iandun (2013-07-26 13:42:05)

I have fixed it! After my mouse started automatically moving to the left side of the screen, even when logged in as root, I thought I would have to go back to Ubuntu, but I was able to read another forum thread about someone who was having the same issue (about the mouse moving left), and said that when he unplugged his joystick, everything worked. I realized that I had a joystick, so I unplugged mine and now everything is working like a charm!

Skype login history for criminal trial? Need IP Li...

Hello,
I am in a situation where a forged skype message is being used in court as evidence against a close friend of mine. We know the message is fraudulent but we need the skype-ip-login-history in order to prove it.
Is there a legal department or mailing address/instructions for obtaining this information? We have obtained legal counsel to officially request the information, but I can't for the life of me find a way to contact the skype legal/security team to obtain these records.
This is very important- the entire outcome of the case currently rests on whether or not this message was falsified. The login credentials to the account were "saved" on several machines and we believe that using the saved information a 3rd party logged in and sent this message to blow up our entire case. An ip-based login history would prove/disprove this theory.
Can someone point me in the right direction? The Skype "community support" area and FAQs did not offer much help.
Thank you very much.

you can try sending an email to [email protected], and hope that they can point you to the right direction. however, Skype usually provide possibly sensitive information such as IP address to the proper law enforcement or similar bodies only.
IF YOU FOUND OUR POST USEFUL THEN PLEASE GIVE "KUDOS". IF IT HELPED TO FIX YOUR ISSUE PLEASE MARK IT AS A "SOLUTION" TO HELP OTHERS. THANKS!
ALTERNATIVE SKYPE DOWNLOAD LINKS | HOW TO RECORD SKYPE VIDEO CALLS | HOW TO HANDLE SUSPICIOS CALLS AND MESSAGES
SEE MORE TIPS, TRICKS, TUTORIALS AND UPDATES in
| skypefordummies.blogspot.com |

How to unlock Root Account in non-global zone on Solaris 10 Branded Zone

Hello All,
I have a phsical x86 server running Solaris 11. On top of that, I have 3 Solaris 10 branded zones configured. Due to security policy the root account has been locked by 5 failed login attempts.
Is there a way by which I can unlock root account in non-global zone.
I have the root access of global zone.
Pls help as these are production servers.
Regards

Hey,
It worked. Actually i forgot to save the file.
I changed the /<zonepath>/root/etc/shadow
Removed *LK* & then from global zone did zlogin -l root zonename
Thanks lot.

Account login

On my account login in page, upon turning on the computer, there is an account labeled "other" that I cannot find in accounts under system preferences. I would like to delete this account, because I'm not sure where it came from, but cannot figure out how to do so. Any thoughts?

That's usually the Root account. But it's not easy to enable that without knowing about it.
There was a thread a little while ago though, where it transpired that the Other account had been added by a third-party application.
Have you recently installed anything?
You can check the root account -
How to disable the root user:
Mac OS X v10.6 and later
    1.    From the Apple menu choose System Preferences....
    2.    From the View menu choose Accounts.
    3.    Click on the lock and authenticate with an administrator account.
    4.    Click Login Options....
    5.    Click the "Edit..." or "Join..." button at the bottom right
    6.    Click the "Open Directory Utility..." button.
    7.    Click the lock in the Directory Utility window.
    8.    Enter an administrator account name and password, then click OK.
    9.    Choose Disable Root User from the Edit menu.
I'll see if I can find the thread I mentioned, but don't hold your breath!

Root account Lockout

Hi all,
since a few weeks, my root account lock every 5 days but I can't figure out why.
I've look in log file but can't see anything that help me figure out what or why the root account lock.
My question is, where can I look to figure out what lock me root account or is there a log that I need to activate to be able to see what's hapening to the root account.
Thx all.
Doug

Does your system log all root login attempts via syslog to auth.log or something similar? If so, do you see any attempts by any user to login? If it is every five days, do you have any scheduled jobs that run some process that tries to log in as root but is failing? Are you running BART or something similar which checks manifests - perhaps you have malware that is editing your /etc/shadow and locking your root for malicious purposes.

Root account .profile file Info required

Hello
(Very New to UNIX - Solaris 10)
Where to admins usually put the root account .profile file ?
I have created other users, and they go into the export/home/user file system and then I rename the local.profile to .profile
The HOME for the root user is /
What I don�t understand is where to put it and will it be automatically picked upon login for root.
Should I create a export/home/root folder , if so will the .profile be picked up here?
Any suggestions?

You would put it under /. When you login as root, it will look for it in the home directory. For security purposes, you shouldn't enable direct root login except from the console.

Root account locked

please tell me if the root account is locked and also
unlocking it

By default on a regular install on a Solaris system, the root login is definitely not locked. If your root login is locked, you can unlock it by:
- booting from a Solaris install CD
- mounting the root directory
- modifying the /etc/shadow file and clear the second field (e.g. the crypted password field)
- reboot
You will now be able to login as root without a password. You should then immediately set the root password to something.

Determine the Root Account

How can I determine which account is the root account? After upgrading computer and moving data via time machine, I have two accounts listed as admin, however the new one I created on new computer does not act like root account.

kflau,
As Nerowolfe suggested keep the spare admin account. Test it for functionality occasionally and keep it in reserve. If your main admin should 'break' you may be able to use the reserve to fix it, or do some other admin task. You should also use a non admin as your day to day browser login. You can switch stuff about using the "Shared" user.
Root is a an admin but more than, and it is best kept in the cupboard. I do on rare occasions see apps telling me when in an admin,'You don't have enough privileges to do "X" and have resorted to root, but that is rare and probably idiosyncratic to the procedure concerned.
Try this; open the Utility app, 'Directory Utility". Click on the lock and enter an admin name and password. Put your mouse on 'Edit" tab and look at the drop down. If it says , 'enable root', then root is disabled. If it says 'disable root' then root is currently enabled. To enable root you enter a password for it. You can give root a password (and any other user for that matter) by booting from the install disk, navigating to the utilities menu (choose a language click to install but don't go the full distance) For most users assign PWs in the user pane in Sys Prefs and for root , in said app Directory utility.
There have been cases reported here where root , and maybe other users have been effectively lost that's once in a blue moon.

Cannot log into root account

After last update, I cannot make system user login:
[user@papa ~]$ su
Password:
su: incorrect password
[user@papa ~]$
At the same time, I can log in into root account with the same password from the framebuffer.
Everything worked OK before update.
Please help.
Last edited by Fixed (2009-02-25 20:37:59)

Are you using the testing branch? There's a bug filed about just such an occurrence: http://bugs.archlinux.org/task/13444 Try and see if su has the SETUID bit set.
Last edited by Slammer64 (2009-02-25 20:41:07)

NetApp Root Account Login History

Similar Messages

Maybe you are looking for