topic Re: Locking User - Effect in Operating System - HP-UX

Locking User - Effect

joe_91 — Wed, 19 Oct 2005 15:13:19 GMT

Team:

What would be the best way to lock a user and how?(both /etc/passwd and NIS) Also two more questions..

1. If the root su's to the locked user-id will it succeed?

2. will the locked users' cron job still run?

Thanks

Joe.

Re: Locking User - Effect

Mel Burslan — Wed, 19 Oct 2005 15:26:42 GMT

to lock a user

on a trusted system
/usr/lbin/modprpw -m alock=YES username

on an untrusted system
passwd -l username

1. yes, root will be able to su to a locked out account

2. no, a locked out user's cron jobs will not run

Re: Locking User - Effect

Ranjith_5 — Wed, 19 Oct 2005 15:35:08 GMT

Hi Joe,

On a trusted system, to lock a user ID, issue the command
----------------------------------------------------------------

#/usr/lbin/modprpw -m alock=YES
======================================================

To unlock the user ID which is locked.
------------------------------------------

#/usr/lbin/modprpw -k

su can be done by root eventhough the account is locked out OR password is expired.

cronjob wont run for those users whose account is locked.

Regards,
Syam

Re: Locking User - Effect

Alan Meyer_4 — Wed, 19 Oct 2005 15:39:50 GMT

I just ran some tests on this and a locked user's cron jobs will still run.

Re: Locking User - Effect

Ranjith_5 — Wed, 19 Oct 2005 15:53:24 GMT

Alan,

are u sure on this? I havent seen this..can u confirm

Regards,
Syam

Re: Locking User - Effect

Alan Meyer_4 — Wed, 19 Oct 2005 16:04:33 GMT

I just reproduced it again. Both in a NIS and in a local environment. Think about, locking the uid just locks the password on the account. By that, it prevents access to the account from the outside.

root can still su to the account and run programs and own processes, so the account can still own and run processes, you just can't log in to it.

The crontab file for the account still exists so cron runs the jobs that exist in the crontab file. Cron does not know, or care if the password is active or not. It just cares that the uid is valid enough to own the process to run the job.

Re: Locking User - Effect

joe_91 — Wed, 19 Oct 2005 16:13:01 GMT

wonderful..so the root can su and the cronjobs will run..to summarize..

Thanks

Joe.

Re: Locking User - Effect

Alan Meyer_4 — Wed, 19 Oct 2005 16:14:37 GMT

That's what my tests have shown.

Re: Locking User - Effect

Ranjith_5 — Wed, 19 Oct 2005 20:50:04 GMT

Good finding...Joe kindly assign assign points to Alan.

Regards,
Syam

Re: Locking User - Effect

joe_91 — Thu, 20 Oct 2005 06:15:03 GMT

Thanks folks. yeah good finding..

Joe

Re: Locking User - Effect

Bill Hassell — Thu, 20 Oct 2005 08:35:57 GMT

The reason that cron still runs on a locked user account is that cron does not login. It runs the jobs on behalf of the owner but does not login. That's why there is a minimal environemnt (no profiles are run unles part of the actual job).

Re: Locking User - Effect

joe_91 — Thu, 20 Oct 2005 09:00:49 GMT

Thanks Bill..

Joe