[comp.sys.att] Breaking into a 3B2/310

dce@smsc.sony.com (David Elliott) (01/14/90)

We recently purchased a used 3B2/310 to use as a comparison machine for
our port of SVR4.  The machine has not been used in a while, and it's
missing a few cables and adapters, but it does come up.  The problem is
that the default init state is set to 2, and the previous owners have
no idea what the root password is.  I made some educated guesses, but
that's futile.

We are also missing the manuals, so we can't RTFM to find out how to
force it into single-user mode.

Can anyone out there help me get this machine to a state where we can
change the root password?

I found a diskette labelled "Floppy Key", but booting with it in didn't
seem to make a difference.

-- 
David Elliott
dce@smsc.sony.com | ...!{uunet,mips}!sonyusa!dce
(408)944-4073
"Baziotes! Baziotes! Getcha red hot Baziotes here!"

pag@tcsc3b2.tcsc.com (Philip A. Gross) (01/17/90)

dce@smsc.sony.com (David Elliott) writes:

>We recently purchased a used 3B2/310 to use as a comparison machine for
>our port of SVR4.  The machine has not been used in a while, and it's
>missing a few cables and adapters, but it does come up.  The problem is
>that the default init state is set to 2, and the previous owners have
>no idea what the root password is.  I made some educated guesses, but
>that's futile.

>We are also missing the manuals, so we can't RTFM to find out how to
>force it into single-user mode.

>Can anyone out there help me get this machine to a state where we can
>change the root password?

I assume that you have the full set of UN*X software for the machine.
If so, then proceed as follows:

Power-up the machine, when the 'DIAGNOSTICS' message is displayed on the
console, press the RESET button on the back of the machine.  Whereupon
it eventually gives you a 'SYSTEM FAILURE' error message, ignore this.
Insert the Essential Utilities Diskette #1 which you will find among
the UN*X OS diskettes.  Then type the firware password (usually 'mcp') 
and get the following prompt:

Enter name of program to execute[]:

Enter /unix.
Whereupon, you will see the following displayed:

Possible load devices are:

Option Number	Slot	Name
-----------------------------
0		0	FD5
1		1	HD72

Enter Load Device Option Number [1 (HD72)]:

Here, you should enter 0.
After some time, the system will eventually boot off of the diskette and
present you with information regarding performing a Full Restore, Partial
Restore, Upgrade, etc.

At this point, you can perform a partial restore, which will restore some
of the essential files and configurations of the system, including the
/etc/passwd file.  Another option is to type 'magic mode' at the prompt.
The system will respond 'POOF!' and present you with another prompt
which lists 'shell' as an option.  If you enter 'shell' at the prompt,
the system will then present you with the '#' UN*X prompt.  Remember that
you are booted on the floppy drive and only have a limited set of commands.
For instance, use 'echo *' in place of the non-existant 'ls' command.

In order to edit the /etc/passwd file on the root filesystem of the 3B2, you
will need to mount the root filesystem to the floppy disk by typing
mount /dev/dsk/c1d0s0 $HARD  (BTW, type 'set' to get a listing of your
environment).  At this point you can edit the $HARD/etc/passwd  using the
'ed' editor to delete the password for root.  After you have finished,
unmount the root filesystem by typing 'unmount /dev/dsk/c1d0s0' and then
exit, whereupon you will be returned to the original menu prompt.  From
here, you can 'quit' and then reboot the system.


===============================================================================
Philip A. Gross       The Computer Solution Co., Inc.       Voice: 804-794-3491
-------------------------------------------------------------------------------
INTERNET:	pag@tcsc3b2.tcsc.com
USENET:		...!tcsc3b2!pag
UUCP:		tcsc3b2!pag	(804)794-1514
ATTMAIL:	attmail!tcsc3b2!pag
-------------------------------------------------------------------------------
        The opinions expressed here are strictly mine and nobody elses.
        << I haven't heard what I have to say about that yet. >> :-)

-- 
===============================================================================
Philip A. Gross       The Computer Solution Co., Inc.       Voice: 804-794-3491
-------------------------------------------------------------------------------
INTERNET:	pag@tcsc3b2.tcsc.com

ttg@gryphon.COM (Ted Garrett) (01/17/90)

Sorry, guy, but you are going to have to obtain a distribution set of unix
and do a re-install from the firmware. (This is because shutdown can only be
run by root and un the root directory).  Once this is accomplished, you'll be
in seventh heaven.

hak@cooper.cooper.EDU (Jeff Hakner) (01/18/90)

in article <24861@gryphon.COM>, ttg@gryphon.COM (Ted Garrett) says:
> 
> 
> Sorry, guy, but you are going to have to obtain a distribution set of unix
> and do a re-install from the firmware. (This is because shutdown can only be
> run by root and un the root directory).  Once this is accomplished, you'll be
> in seventh heaven.


HOLD ON!  Before you kill everything by doing this, try using magic mode.
I forget the exact details, as I've only needed it rarely, but the idea
is: you power on the machine.  At the right time, I think during
diagnostics, hit the reset button in the back.  The cursor will space
forward twice.  Type in the firmware password, which, unless it was
changed, defaults to "mcp".  Enter nothing for file to execute, and
then select the floppy to boot from.  At some point (here's where my
memory fails me) you get to a menu that has entries like "install upgrade",
"dual-disk upgrade", or somesuch.  Type "magic mode".  The system
reponds "poof!"  It then allows you to type "shell" and get a root,
stand-alone shell.

From there, you'll have to mount the hard-disk root file system
and use ed to remove the passwd for root.  Sync up and 
go back to firmware with /etc/uadmin 2 2.

I'm sorry I can't give all the details right now, but its
getting a little late and I'm getting sleepy.  The point is, look into
this method.  If you need more info, I could help.  Also, 
Stephen J. Friedl of V-systems wrote a good article about this stuff.
Maybe he's watching now??!!