topic Re: Password history Depth in Operating System - HP-UX

Password history Depth

Nick D'Angelo — Tue, 29 Mar 2005 08:03:32 GMT

All,

HPUX 11i

I am trying to setup the Password_history_depth so that users will be prevented from re-using the previous 6 password.

I have added the file /etc/default/security and included the line: PASSWORD_HISTORY_DEPTH=6 in it and it is readable by everyone.

However, I have experimented on my test server with one user account and it did not remember the previous password, therefore I do not believe it is working as expected.

Did I miss something?

Thanks

Re: Password history Depth

Pete Randall — Tue, 29 Mar 2005 08:08:12 GMT

Nick,

According to the man page, this feature "is supported in trusted system for users in files repository only. This feature does not support the users in NIS or NISPLUS repositories."

Are you on a trusted, non-NIS system?

Pete

Re: Password history Depth

Nick D'Angelo — Tue, 29 Mar 2005 08:09:43 GMT

Thanks, NO NIS or NISplus is being used.

Re: Password history Depth

HGN — Tue, 29 Mar 2005 08:39:23 GMT

Hi

This feature works only in trusted mode, you can change the system a test system to trusted mode and see if that works out for you.

Rgds

HGN

Re: Password history Depth

Bill Hassell — Tue, 29 Mar 2005 09:50:19 GMT

The password history for each user is stored in /tcb/files/auth, so if you don't have this directory, your system is not Trusted and virtually none of the password controls mentioned in the security man page will work.

Re: Password history Depth

Sunil Sharma_1 — Tue, 29 Mar 2005 09:51:09 GMT

Hi,

Please see man page of security. It says " The pasword history depth configuration is on a system basis and is supported in tructed system for users in files repository only"

So this can be possible in trusted mode only and If you are using files then only. It does not support NIS

Sunil

Re: Password history Depth

Nick D'Angelo — Tue, 29 Mar 2005 10:29:15 GMT

Thank you all.

Bill H - question

What if I don't have a /tcb/files/auth etc directory? Can I just create one?

Re: Password history Depth

Pete Randall — Tue, 29 Mar 2005 10:31:26 GMT

You'll need to convert your system to trusted, either by going through SAM (recommended) or running tsconvert.

Pete

Re: Password history Depth

Bill Hassell — Tue, 29 Mar 2005 10:40:39 GMT

Nope. /tcb is the Trusted Computing Base directory and is meaningless without the Trusted conversion. Go into SAM and select Auditing and Security. You'll be asked to convert to Trusted. NOTE: is you use tsconvert (which is hidden in /usr/lbin) all the passwords will be expired immediately. SAM will enable all the logins. Note also that if anyone user on your system (including root) has a password more than 8 characters, during the conversion the password will be honored only when 8 characters are entered. If you enter more, it will be rejected. This is because your un-trusted system silently ignored the extra characters.

Once converted to Trusted (takes a minute or so), SAM will now have additional features including system-wide security policies including password history.

Re: Password history Depth

Nick D'Angelo — Tue, 29 Mar 2005 10:41:03 GMT

Peter, thank you.

Will it require a reboot?

Re: Password history Depth

Bill Hassell — Tue, 29 Mar 2005 10:42:55 GMT

Nope, no reboot necessary. Existing user sessions are untouched, new users can login with no visible differences except they will now see when they last logged in successfully and when they last failed to login successfully.

Re: Password history Depth

Nick D'Angelo — Tue, 29 Mar 2005 11:11:52 GMT

Hmm, it errored with a -1 while trying to configure this on my test server using SAM.
This was the error:

he attempt to convert this system to a trusted system failed. The x x
x [x command return value was "-1" and the standard error output was: x x
x x Can't write protected database; x x
x [x password file unchanged.

??

Re: Password history Depth

Nick D'Angelo — Tue, 29 Mar 2005 11:16:15 GMT

Sorry All, I was a little too quick to post my error.

I found a user account in /etc/password that had a # as its first character. Once I removed this, and re-ran Sam - it converted to a trusted host no problem.

THanks anyhow.

Re: Password history Depth

Pete Randall — Tue, 29 Mar 2005 11:17:10 GMT

Are you running short of space in your / file system? Run a bdf and check.

Pete