QNX2.21/3.21 default login Or How do I get root on QNX 2.2

I am tasked with converting an old QNX 2.21 system to a VM running n modern hardware.
A search has turned up a P75 which was allegedly supplied as a spare for the existing 486 some years back.
Writing on the case suggests this may have a copy of both the OS and the actual program we need which would avoid disturbing the running 486. Which is running some vital bits of process machinery. I am very reluctant to interfere with this machine in any way as it is a single point of failure and would not like to bet on it rebooting correctly if it is ever shut down.
The P75 boots up OK but goes straight into another control program which is irrelevant to our needs at this time.
ctrl+alt+5 takes me to a login screen but if any login credentials were supplied, they have been lost a long time ago. It MAY be possible to contact the outfit that supplied the spare P75 but to possibly shortcut that…

Was there a default login/pwd combo for QNX2.21/3.21?

root/root admin/admin and root/password dont work - probably a good thing in almost every instance except this one.
Neither do various other semi-probable login/pwd combos.

How can I get root on a QNX 2.21 box?

Any advice welcome - Thanks :slight_smile:

Did you try checking other consoles to see if any of them ‘auto logged’ in?

ctrl+alt+5 checks the 5th console. What about console 1-4 or 6-9?

Masochen will probably comment more on this since he’s the resident expert on QNX 2. But from what I remember (20 years ago now) the only way in was:

  1. with a password which you don’t have
  2. By booting QNX 2 off a floppy, mounting the harddrive manually and then replacing the password file with one where you know the passwords.


Thanks Tim,
Yes I tried the other consoles, some referred to the already running control prog, another was something to do with the Arcnet which is of little use to me right now but may be handy later. This P75 has 3 Arcnet cards while the 486 has none. If we do risk powering down the 486, I can see some hardware swapping happening. Then I need to find my old Co-ax crimping tool and make a cable…
The good news is, I rebooted the P75 and caught a message that had eluded me before.
login as QNX and no passwd gets me a guest session which I have not had much time to explore yet but it certainly moves me along a bit and I can explore some of the disk contents :slight_smile:

Hopefully I will find enough to let me build a bootable floppy.

There are three modes for logging into a QNX 2 system.

Passwords off
This is the default. In this mode your login id can be one of two things.

  1. The name of a directory under /user. The only supplied directory is “qnx”, but there may be others.
  2. A full path directory name, try “/”.
    With passwords off, you always login as root

Passwords on
This mode is turned on by typing the command “passon” into a shell. This is sometimes done in the sysinit file.
When this happens, only user-id’s specified in the /etc/passwd file can be used. This file also has a plain text password, so by booting off of a floppy it is always possible to mount the hard disk, and look at this file.

Password-admin in use
This was a rarely used option. A password administrator was run at startup. It provide encrypted passwords. I don’t recall much about this as I did not use it.

As mentioned by Tim, it is always possible to boot off of a floppy and interfere with the existing sysinit, allowing you to get control. Not very secure of course, but there is no internet.

A 2ndary way of breaking into a QNX 2 system if it has a Network card involves using another system where you boot into root mode. Then you can usually access the file system remotely.

I can’t think of a reason that the system would have 3 Arcnet cards. Are they standard arcane cards or Corman Arcnet cards?

If you can login as qnx, you should try logging in with just a forward slash ‘/’, no quotes.

What is the prompt you see? $ or #

Apologies for the delay in replying.
We have managed to unearth a 600 page PDF of the QNX 2.2 reference guide, so I am in a much better place than a couple of days ago. If it can legally be shared with this community then I will ask permission to do so from the client.

I can login as user: qnx password: qnx and get a $ prompt.
LOgging on as / fails.
How can I tell whether these are arcane or Corman Arcnet cards? I need a very good reason at this stage to open this case until I am a little further along.
From the outside they just look like old 10BaseT cards with a co-ax socket - one card has some DIP switches and two RJ-11 sockets, another has a power(?) LED - seems to be always on and the last card simply the co-ax socket.

First up I intend to read through the manual and attempt to build a boot floppy and see if I can boot from that.
The mount command tells me I have a 515Mb HDD and a floppy. Using ctrl-Z I can now log in on other consoles.
There is no vi so I need to go and read up on ed which I was shown once about 20+ years ago after I complained that vi was too much hassle. I soon stopped complaining about vi and learned to love it.

The $ prompt indicates you have root privileges. No need to make a boot floppy to get root access.

Here is a link to a PDF of QNX 2 that you may find helpful

tenox.net/docs/qnx/qnx21_ope … system.pdf


So passwords are on. Since you can login as qnx this doesn’t matter.

The cards with DIP switches and RJ-11 sockets are not Corman. The card may be a Corman. There are two ways to tell.

  1. At boot up, you may briefly see in the middle of the screen the text “Node #”. If at that moment you press Esc you will see a menu provided by the Corman BIOS that will let you do various things, eg. change parameters stored on the card, or decide whether to boot via disk or network.
  2. After booting and login in, type the command “$ tsk info”. This will give you three or so lines of information. One of these will be the node number. If the node number is anything but 0, you have a Corman card installed.

A few comments. I still love ed, or as it’s now known qed. It amazes me that after almost 30 years QNX dropped it in v 6.6. Very strange.
The main oddball thing you need to know to use qed is how you go from command mode to edit mode and back. Command mode lets you enter commands on the next to top line. Edit mode lets you change text in the lines below. To get from command mode to text mode, you either enter a command and press Enter, or you just press Enter. To get back you press the big Plus sign in the numeric keypad. If your keyboard doesn’t have a big Plus sign on the right, using ed is very difficult. There are a number of useful command implemented a function keys 1-8.

If you need to create a boot floppy, I can help you out. Here is a brief description.

  1. format the floppy with fdformat
  2. initialize the floppy with dint
  3. make directories /cmds /config /user /drivers on the floppy
  4. copy various commands from the hard drives /cmds directory to the floppies:
    mount, login, sh, ls, etc.
  5. copy needed drivers to /drivers, probably the disk.at at the very least.
  6. create a startup script called /config/sys.init on the floppy. It doesn’t really need anything in it
  7. copy the os to the floppy.
8) run the boot command

I think that’s enough.