...

...

The manual seems to indicate that once the password for the root has been fed into the system during installation then it cannot be changed by any means. Then it needs rewritten or you didn't read it right. I would like to change my (root) password. Can this be done? Or do I need to reinstall the whole sheebang logged in as root type passwd that's all there is to it. Thank you. I guess I should do 'passwd ', yes?

No, just "passwd", you will be prompted. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Basil Chupin wrote:

Dave Cotton wrote:

...

On Mon, 2007-03-19 at 23:45 +1100, Basil Chupin wrote:

...

The manual seems to indicate that once the password for the root has been fed into the system during installation then it cannot be changed by any means.

Then it needs rewritten or you didn't read it right.

...

I would like to change my (root) password. Can this be done? Or do I need to reinstall the whole sheebang?

logged in as root type passwd that's all there is to it.

Thank you.

I guess I should do 'passwd ', yes?

Cheers.

Enter the passwd command. You will then be prompted for the old password etc. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Dave Cotton wrote:

On Mon, 2007-03-19 at 10:00 -0400, James Knott wrote:

...

Enter the passwd command. You will then be prompted for the old password etc.

Are you sure?

Yes. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Dave Cotton wrote:

On Mon, 2007-03-19 at 12:42 -0400, James Knott wrote:

...

Dave Cotton wrote:

...

On Mon, 2007-03-19 at 10:00 -0400, James Knott wrote:

...

Enter the passwd command. You will then be prompted for the old password etc.

Are you sure?

Yes.

The please type passwd when logged in as root and see what happens, because you will not be asked for the old password.

see below

/home/dave # passwd Changing password for root. New Password: Reenter New Password: Password changed.

Sure now?

Curious. It asks for the old password, when changing as a user, but not when as root. That means that if someone finds an open root session, they can change the password! -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Mon, 2007-03-19 at 13:13 -0400, Jonathan D. Arnold / Daemon Dancing wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

I'm a new OpenSUSE user, after years of FreeBSD and other Linux distros, and I've been extremely pleased with my week long experiment with OpenSUSE. I'll be documenting my odyssey a little more on my blog.

And still do not know how to use mailing lists correctly. New subjects require a clean start and not using incoming messages with there titles and content wiped out. -- Dave Cotton -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Randall R Schulz wrote:

Dave, Jonathan,

On Monday 19 March 2007 10:35, Dave Cotton wrote:

...

On Mon, 2007-03-19 at 13:13 -0400, Jonathan D. Arnold / Daemon Dancing

wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

I'm a new OpenSUSE user, after years of FreeBSD and other Linux distros, and I've been extremely pleased with my week long experiment with OpenSUSE. I'll be documenting my odyssey a little more on my blog. And still do not know how to use mailing lists correctly.

New subjects require a clean start and not using incoming messages with there titles and content wiped out.

I usually assume that people do this because they do not understand that issuing their mailer's "reply" command (for the convenience of getting a destination address pre-entered) and replacing the "Subject:" is not the same thing as using the "new message" command and entering both an address and a subject.

Actually, there's a much simpler (and lazier) reason - I didn't have an alias set up for it yet, and as Thunderbird automatically adds one when you reply to a message, that's what I did (he says, head down and feet scuffing the ground)...

Jonathan: Since you're switching to KDE, KMail is highly recommended. It's a very good, very powerful and generally easy-to-use mail client.

I've tried both KMail and Evolution and am still wedded to Thunderbird. I think it has the best keyboard navigation of any email client. -- Jonathan Arnold (mailto:jdarnold@buddydog.org) Daemon Dancing in the Dark, a FreeBSD weblog: http://freebsd.amazingdev.com/blog/ UNIX is user-friendly. It's just a bit picky about who its friends are. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On 3/19/07, James Knott wrote:

Curious. It asks for the old password, when changing as a user, but not when as root. That means that if someone finds an open root session, they can change the password!

root can change anyone's password without knowing the current password so in general once you get logged in as root you own the machine. Encryption is one tool used to ensure your private docs remain your private docs. OTOH, one of the goals of Secure Linux is to give individual users privacy from root. I have not attempted to follow the progress so I don't know how effective it is at the attempt. Greg -- Greg Freemyer The Norcross Group Forensics for the 21st Century -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

James Knott wrote:

Dave Cotton wrote:

...

On Mon, 2007-03-19 at 12:42 -0400, James Knott wrote:

...

Dave Cotton wrote:

...

On Mon, 2007-03-19 at 10:00 -0400, James Knott wrote:

...

Enter the passwd command. You will then be prompted for the old password etc.

Are you sure?

Yes.

The please type passwd when logged in as root and see what happens, because you will not be asked for the old password.

see below

/home/dave # passwd Changing password for root. New Password: Reenter New Password: Password changed.

Sure now?

Curious. It asks for the old password, when changing as a user, but not when as root. That means that if someone finds an open root session, they can change the password!

Not really curious, as root has the ability to edit the /etc/shadow file. Or, create a new account with an account id of 0. Root can change anyone's password, without knowing the password. Without that capability, how could a system administrator correct forgotten password situations. Bill Anderson -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Monday 2007-03-19 at 13:05 -0400, James Knott wrote:

Curious. It asks for the old password, when changing as a user, but not when as root. That means that if someone finds an open root session, they can change the password!

So what? They can mkfs the whole thing! :-p - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFF/vF2tTMYHG2NR9URApuvAJ4kqREOiSwDhqC4e5NoMMix7FwOCQCdG3yi wgXceBHY+Emw/zBxD6yGctY= =mXR0 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Hi, On Mon, 19 Mar 2007, Frank Sundermeyer wrote:

...

The manual seems to indicate that once the password for the root has been fed into the system during installation then it cannot be changed by any means.

as one of the documentation guys at SUSE I would be interested in what manual and chapter you are referring to.

I bet this is about the little box in the installation chapter that tells users to make sure they remember their password well, because there's no way to *retrieve* the password again (means "print and read"). AFAIK, this isn't about a user not being able to create a new password. But then again, you'd need the old root password to become root and be able to change it ... *just wondering* Jana -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Monday 19 March 2007 19:44, Anders Johansson wrote: Hi,

On Monday 19 March 2007 16:11, Jana Jaeger wrote:

...

But then again, you'd need the old root password to become root and be able to change it ...

Well, no, all you need is physical access and a rescue system CD :)

well, yes, ;-) that would be one way. But you will _never ever_ see documentation about how to break into the system within the official manuals. Feel free to write a Wiki article. -- Regards Frank Frank Sundermeyer, Technical Writer, Documentation SUSE Linux Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg Tel: +49-911-74053-0, Fax: +49-911-7417755; http://www.opensuse.org/ SUSE Linux Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) "Reality is always controlled by the people who are most insane" Dogbert -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Tuesday 2007-03-20 at 12:08 +0100, jdd wrote:

Frank Sundermeyer wrote:

...

well, yes, ;-) that would be one way. But you will _never ever_ see documentation about how to break into the system within the official manuals. Feel free to write a Wiki article.

I think it's already there.

This position is understandable, but also questionable.

Arguably so.

In fact, IMHO there should be at least an exclamation mark saying "it's pretty easy for any people with physical access to a computer to defeat any root passwd on non-encrypted system. Strong encryption is the only somewhat safe mean to protect sensitive data, at the cost of the risk of losing this data is the password is forgotten"

may be it's already there :-)

I think that it should be indeed documented in the manual. Security by obscurity gives a false sense of security: the novice may thing that his computer is safe just because the root password is unguessable, neglecting to protect the access to the physical computer. Explicitly documenting how to replace the root password without knowing it, using a rescue CD or whatever is a most, because that way the novice is shown how easy is to bypass that password and how important it is to secure the computer. Plus it is a needed knowledge should an admin forget the password (eeks!), or be put in charge of an already installed system. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFF/8pWtTMYHG2NR9URAvQcAJ9aA0xpv5bd+1PldXaZwUHfiYuxdACfREaX kTXYr2EUG68yepIo+pzcpuc= =xeX7 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Tuesday 2007-03-20 at 13:42 +0100, Frank Sundermeyer wrote:

...

I think that it should be indeed documented in the manual. Security by obscurity gives a false sense of security: the novice may thing that his computer is safe just because the root password is unguessable, neglecting to protect the access to the physical computer.

sorry if I start to get a little bit angry, but I _strongly_ suggest reading the manual _before_ discussing it's contents or complaining about allegedly missing content.

Sorry, but you yourself said it was not going to be documented:

...

well, yes, ;-) that would be one way. But you will _never ever_ see . . . . . . . . . . . . . . . . . . ^^^^^^^^^^^^^^^ documentation about how to break into the system within the official manuals. Feel free to write a Wiki article.

My opinion is that it should be documented. (I did read the manual, back when it was in paper...) - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFF/+XdtTMYHG2NR9URAihmAKCCkDYhT2DYeDZ8mDO9CmBRNlNmfACfRjgV 91bDTnsZjjCBS6Bm+ogKOz0= =Jg/j -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Frank Sundermeyer wrote:

On Monday 19 March 2007 13:45, Basil Chupin wrote:

Hi Basil,

...

The manual seems to indicate that once the password for the root has been fed into the system during installation then it cannot be changed by any means.

as one of the documentation guys at SUSE I would be interested in what manual and chapter you are referring to. Suse 9.2 Pro Manual, p32, last 2 sentences of last para on that page, "Do not forget the root password. Once entered, this password cannot be retrieved."

I interpreted that the way I spelt it out in my original post. Once in, nothing can be done about it. But my interpretation is wrong 'cause using passwd will change it <g>. Cheers. -- Trust, once lost, cannot be regained. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Tuesday 2007-03-20 at 10:14 +0100, Frank Sundermeyer wrote:

Please read the quote from the manual again. The sentence says that you should not forget your password because there is no way the system will tell you this root password (unless it is a weak one and you run a password cracker - but that is a different matter and surely not one we will document).

Then look again: the weekly security script does that automatically :-P - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFF/8q3tTMYHG2NR9URAtP9AJ9qzUCPR5AZ79VyiS43kFmTO77rtwCfbqC4 zmrJBqZGkeW3JA6MCy3T67A= =R8v4 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Tuesday 2007-03-20 at 08:11 -0700, Randall R Schulz wrote:

...

Then look again: the weekly security script does that automatically :-P

Yes, if you have "john" installed, in which case within five to seven days of each weekly initiation of that program, you'll know whether it could guess your system's passwords...

Right. And the following week it will try to break the very same passwords it tried the previous week. - -- Cheers, Carlos E. R. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD4DBQFGAACFtTMYHG2NR9URAnR7AJ9To+wOSfrxLHNguTK7A4GX3d25WwCY/mym rKU4hgV/2CDwW81TcypRFQ== =WCTZ -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

It's true what you say there, oddly enough some of the (simple) stuff is impossible to find in a manual, your problem is a perfect example of that. On Tue, 2007-03-20 at 18:40 +1100, Basil Chupin wrote:

Basil Chupin wrote:

...

The manual seems to indicate that once the password for the root has been fed into the system during installation then it cannot be changed by any means.

I would like to change my (root) password. Can this be done? Or do I need to reinstall the whole sheebang?

Cheers.

Thanks to all who replied and telling me that passwd will do what I want to do. I couldn't see anything in DaBigGreenManual which would solve my need.

Cheers.

-- Trust, once lost, cannot be regained.

Kind regards "Define success the way customers do" Resellers of all Nomachine terminal server solutions Nomachine Resellers of Vizual HR Management solutions Vizual Resellers of Graphon Go-Global Graphon Certified reseller of all HP client and server products HP Resellers of all IBM Solutions IBM Founders of Migrating to linux Migrating to Linux Registered Premium partner of Cisco Members of the Hibiscus Chamber of Commerce -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

The manual is useful for newbies and bragging rights to prove you supported the distro of choice by buying rather than simply installing your copy. For useful books the main publisher is O'Reilly which is a dot com without the tick mark. There are other books out including Suse 10 Unleashed. I usually get books via the LUG because we have a deal to read and review and I have a Micro Center near me which usually has older editions cheap. As I am a beginner to Perl I figure the older ones will do fine until I have the green stuff for newer more comprehensive books. So do not worry about being newbie we were all there once even the old codgers over 65.

Per Qvindesland wrote:

...

It's true what you say there, oddly enough some of the (simple) stuff is impossible to find in a manual, your problem is a perfect example of that.

____ _ _ _ ____ _ _ _ | | | | [__ | | | |___ |_|_| ___] | \/

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org