topic Re: Limit login attempts without trusted system in Operating System - HP-UX

Limit login attempts without trusted system

jmb — Wed, 18 Feb 2004 17:45:39 GMT

Is there a way to limit the number of times a password can fail before the account is automatically locked? I see /etc/default/security, but no way to handle that particular parameter.

Perhaps a trusted system is the only way?

Re: Limit login attempts without trusted system

A. Clay Stephenson — Wed, 18 Feb 2004 17:57:55 GMT

Unless you feel up to writing your own custom login program and a database to keep up with login attempts then Trusted is your only option. In the Old Days of UNIX, when dinosaurs roamed the Earth, it was quite common to do your own login.

Re: Limit login attempts without trusted system

Sridhar Bhaskarla — Wed, 18 Feb 2004 18:01:03 GMT

Hi,

I believe you cannot enforce the account lockout on bad login attempts without converting the system to trusted. You can apply quite a few restrictions with /etc/default/security (man security for more information). But this feature is available with trusted systems.

-Sri

Re: Limit login attempts without trusted system

Michael Tully — Wed, 18 Feb 2004 18:02:15 GMT

The only way is trusted. I wasn't around with the dinosaurs, but I do remember reading about these custom logins.

signed T-Rex

Re: Limit login attempts without trusted system

jmb — Wed, 18 Feb 2004 18:08:10 GMT

OK, that's what I thought..

And on a related issue, are there any "gotchas" with converting to trusted? I've read previous threads about losing current passwords, and also keeping a couple of root sessions going until after the conversion.

Can this be convert be done on larger, older (11.0, 11i)) systems with relative ease? Any reasons to NOT do it?

Re: Limit login attempts without trusted system

Sridhar Bhaskarla — Wed, 18 Feb 2004 18:17:50 GMT

Hi,

This can be done relatively easy. Make sure the following

1. encrypted password entries from /etc/passwd are not being used by anything on the system.
2. User accounts will be immediately expired. After converting the system to trusted, immediately un-expire the passwords. You can do it through either by SAM or with the command '/usr/lbin/modprdef -m exptm=0"

You may face issues with the users that have the passwords longer than 8 chars before. Ask them use only the first 8 chars until they change their passwords.

You can use the command 'tsconvert' to convert and 'tsconvert -r' to unconvert.

-Sri