topic Password expiry in a trusted system in Operating System - HP-UX

Password expiry in a trusted system

Amruth — Tue, 19 Oct 2004 19:01:10 GMT

Hello all,

We have nearly 60 HP UX (Trusted 11.x) systems and according to the policy the password expires after 60 days.

Now my aim is to automate the notifying users when the passwords are near to expiry.

Any thoughts on this...Like a script.

Thanks in advance,
Amruth

Re: Password expiry in a trusted system

Sridhar Bhaskarla — Tue, 19 Oct 2004 19:14:30 GMT

Hi Amruth,

You can configure the systems with expiry warning time so a message will be displayed beyond that time for the users. However, there is no way a user will know if he/she doesn't logon to the system.

I started implementing it but haven't done yet due to our site policies.

My idea was to

1. Create a file say /etc/expirytab every day night at 12:00 AM. It's a comma seperated file with user, date of the last password change, date of expiry and days left before password expiry.

2. Run a script 'script2' that will send mails to users based on the 'days left before password expiry in /etc/expirytab file.

As you can see writing the script for 2 is very easy. So, I leave it to you.

For getting the expiry information, here is the script. You may need to add some checks like if the user file is not there etc., etc. otherwise 'awk' will hang.

#!/usr/bin/ksh

EXPIRE=60
NOW=$(/usr/contrib/bin/perl -e 'printf "%d\n",time()')

if [ ! -d /tcb ]
then
echo "Only on trusted systems"
exit 1
fi

rm -f /etc/expiry.tab

for USER in $(logins|awk '{print $1}')
do
FIRST=`echo $USER|cut -c1`
USERFILE="/tcb/files/auth/${FIRST}/${USER}"
THEN=$(awk '/u_succhg/ {FS="u_succhg";print $2}' $USERFILE | awk '{FS=":";print $1}'|sed '
s/#//')
WHEN_CHANGED=$(echo 0d${THEN}=Y | adb)

(( EXPIRES_ON_DATE = $THEN + ( $EXPIRE * 86400 ) ))
(( EXPIRES_IN_DAYS = ( $EXPIRES_ON_DATE - $NOW ) / 86400 ))

EXPIRES_ON_DATE=$(echo 0d${EXPIRES_ON_DATE}=Y |adb)

echo "$USER,$WHEN_CHANGED,$EXPIRES_ON_DATE,$EXPIRES_IN_DAYS" >> /etc/expirytab
done

-Sri

Re: Password expiry in a trusted system

Sridhar Bhaskarla — Tue, 19 Oct 2004 19:27:00 GMT

Sorry.. I couldn't help you.

Re: Password expiry in a trusted system

Amruth — Tue, 19 Oct 2004 19:29:15 GMT

Sri,

THanks for your quick answer.

My first problem is to find out when the password of a user will expire.

Thanks,
AM

Re: Password expiry in a trusted system

Sridhar Bhaskarla — Tue, 19 Oct 2004 19:36:48 GMT

When you run the script, it will create a file /etc/expirytab with all those details. Run the script every night to update it. Once you have all the details, you can do anything you want.

-Sri

Re: Password expiry in a trusted system

Amruth — Tue, 19 Oct 2004 20:03:26 GMT

Sri,

I am gonna check this out and will get back to you...

Thanks a lot..

AM