topic Re: password aging in Operating System - HP-UX

password aging

M. Tariq Ayub — Wed, 14 Jan 2004 21:56:51 GMT

Hi,

i have 2 question regarding password aging

1. Can it be set for all user at a time. ie when new user is created he will automatically have the same policy.

2. Can i set message that will appear to a user 5/6 days before password expires.

Khashru

Re: password aging

Michael Tully — Wed, 14 Jan 2004 22:07:18 GMT

You can set it system wide.
sam --> auditing and security --> system security policies --> password aging policies
or you can set it individually.
accounts for users --> users --pick you user --> actions --> modify security policy

As far as the warning is concerned, this in the system wide password aging policies and shown above. (password expiration warning time) which you can set to however many days you like.

Re: password aging

M. Tariq Ayub — Wed, 14 Jan 2004 22:13:55 GMT

Hi,

i donot have trusted system. And i donot want to do that. In that case how can i set machine wide and also add message.

Re: password aging

Michael Tully — Wed, 14 Jan 2004 22:35:49 GMT

As far as I know you can't set these policies without your system being trusted. Changing to trusted sets up a database for a variety of password aging functions.
The only aging you can use for passwords is time related and you cannot create warnings without writing a quite detailed script. See man 4 passwd for details on setting up the actual aging.

Re: password aging

Steven E. Protter — Wed, 14 Jan 2004 22:56:02 GMT

You can set these passwords with the passwd command by running a script.

the variables are descriptive.

# passwd -r file -n $MINDAYS -x $MAXDAYS $user

How and when to trigger it, is your part of the job.

SEP

Re: password aging

Sunil Sharma_1 — Thu, 15 Jan 2004 01:35:31 GMT

Hi,

Yes, you can do it, if you are running on HP UX 11i and installed a additional product called HP ShadowPassword Bundle.

It will add 3 parameters in /etc/default/security file which can be used to acheive it. after installing this /etc/passwd file will not have encrypted password, these will be moved to /etc/shadow file.

it can be done without converting system into trusted mode.

read this for more info

http://newfdawg.com/SecBook-2.4.1.htm

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ShadowPassword

Sunil