Password Depth in Trusted Systems

[Ryan B]

I am running 11.00 and Trusted Systems

I am setting PASSWORD_HISTORY_DEPTH=10 and from other things I read, it appears it's system wide, but is there a way to exclude specific users from this history depth on a given box when the depth is set?

Thanks in advance for the help!

[doug hosking]

Sorry, but there is no (sane) way to do that.
To bypass it you would have to temporarily
alter/rename /etc/default/security or remove
the corresponding history file for the
user(s) you want to exempt.

[Stefan Farrelly]

It says it clearly in the man page - once this feature is set it applies to ALL users.

[James Beamish-White]

From the manual - "Once the feature is enabled, all the users on the system are subject to the same check."

If you want to achieve this, you may have to reseach HP's implementation of C2 security, figure out where the password history is held, and edit it as root to remove 'old' passwords.

Cheers,
James

[James Beamish-White · Accepted solution]

Try looking in /tcb/files/auth/system/pwhist

Cheers,
James

[Ryan B]

Thanks to everyone who replied. I understand the man page/ documentation, but sometimes when you have a test box you have to try things. Anyway, the pwhist dir contains the files for each user and actually removing one the one for the user you want clears the history. I know this may not be recommended and I am not sure if there are other consequences, but it's a test box and it works. Now to determine if we want to roll the dice...

Thanks