topic Re: Modifying a user questions in Operating System - HP-UX

Modifying a user questions

dictum9 — Tue, 29 Nov 2005 14:58:15 GMT

What exactly happens when a user gets modified with SAM?
I need to change the user name from one login to another and:
(1) I modify it in SAM
(2) Run vipw and change the home directory to new username
(3) rename the home directory from old login to new login

Is there a way to script the whole thing?

Re: Modifying a user questions

Jeff_Traigle — Tue, 29 Nov 2005 15:02:30 GMT

I'm not sure what SAM does, but this is a simple one-liner from the command line.

usermod -l newusername oldusername

That's the basic one for just changing the username. You can use -m to create the new home directory also. Several other options for changing the shell, GECOS field, UID, etc. See usermod(1M).

Re: Modifying a user questions

A. Clay Stephenson — Tue, 29 Nov 2005 15:02:59 GMT

Yes, of course there is a way to script the whole thing. However, it matters whether or not this is a trusted system as to exactly what happens. The key to your task is the usermod command which will work in both Trusted abnd unTrusted environments. Man usermod for details.

Re: Modifying a user questions

Jeff_Traigle — Tue, 29 Nov 2005 15:04:23 GMT

BTW... the man page says -m option moves the home directory. That's not really accurate from my experience with the command. It copies the contents of the old home directory into the new one and modifies /etc/passwd accordingly, but the old home directory remains and you must remove it manually if so desired to clean up.

Re: Modifying a user questions

dictum9 — Tue, 29 Nov 2005 15:39:35 GMT

Thank you... Another question.

I want to set password aging to 90 days and prompt for password change upon login.

I am looking at modprpw and it has these options, what's the difference?

exptm=value database u_exp=(value*86400).

Set password expiration time interval (days).
0 = expired. Same as non-trusted mode
maximum time.

lftm=value database u_life.

Set password life time interval (days). 0 =
infinite.

Re: Modifying a user questions

dictum9 — Tue, 29 Nov 2005 15:49:43 GMT

How do I make the system prompt the user for a new password with the next login?

In SAM, it is called immediate password change.

Re: Modifying a user questions

A. Clay Stephenson — Tue, 29 Nov 2005 15:51:27 GMT

You "age" the password via the "passwd -f login" command. Man passwd for details.

Re: Modifying a user questions

Jeff_Traigle — Tue, 29 Nov 2005 15:58:57 GMT

Set the maximum password time:

/usr/lbin/modprpw -m exptm=90 username

Expire immediately:

/usr/lbin/modprpw -e username

Set password to random value (user forced to change on next login):

/usr/lbin/modprpw -x username

Re: Modifying a user questions

Raj D. — Tue, 29 Nov 2005 16:03:05 GMT

Hi etc ,

You can also set the password age , with SAM.

SAM --> Accounts for Users and Groups -> Users --> Select user --> Action --> Modify --> Modify Password Options --> Select " Password Options: " to : Enable Password Aging.

And you will get the following options:

Password Options: [ Enable Password Aging ]

Password Expiration Time (1-63 weeks):

Minimum Time Between Password Changes (0-63 weeks): 0

[ ] Force Password Change At Next Login

Enjoy ,

hth,
Raj.

Re: Modifying a user questions

dictum9 — Tue, 29 Nov 2005 17:25:37 GMT

passwd -x

rounds it up to the week, ie. passwd -x 60 results in the actual value being set to 63 if checked in sam. How can I override that?

Re: Modifying a user questions

Jeff_Traigle — Tue, 29 Nov 2005 17:28:52 GMT

You can't. That's the way it works.

Re: Modifying a user questions

dictum9 — Tue, 29 Nov 2005 17:33:03 GMT

In other words, if I want the precise value of say 60 says for password expiration, I have to use SAM?

Re: Modifying a user questions

Jeff_Traigle — Tue, 29 Nov 2005 17:33:21 GMT

Let me restate that... the passwd man page seems to indicate that behavior is what to expect from a nontrusted system. It doesn't explicitly say that it behaves differently on a trusted system, however. "/usr/lbin/modprpw -e exptm=60 username" will set the expiration period to exactly 60 days.

Re: Modifying a user questions

dictum9 — Tue, 29 Nov 2005 17:35:11 GMT

I did -m exptm=60 but when I looked in sam, the old value was still there... Is that -m option equivalent to password -x?

Re: Modifying a user questions

Jeff_Traigle — Tue, 29 Nov 2005 17:35:52 GMT

Oops... sorry about a typo in that last message. The command is:

/usr/lbin/modprpw -m exptm=60 username

Re: Modifying a user questions

dictum9 — Tue, 29 Nov 2005 17:53:16 GMT

That seems to work.. thank you.

Re: Modifying a user questions

dictum9 — Wed, 30 Nov 2005 09:14:07 GMT

I am still having problems. I ran the following command

/usr/lbin/modprpw -m exptm=60

but when I checked in SAM, where it says:

Set user-specific password aging policies ...

the following field was not modified.

Password Expiration Time (days): 60

Why is this happening and what can be done about it?

Re: Modifying a user questions

dictum9 — Wed, 30 Nov 2005 09:15:12 GMT

PS in the above example, the two values are the same (60) but in SAM, it stayed 60 no matter what value I used on the command line.

Re: Modifying a user questions

Steven E. Protter — Wed, 30 Nov 2005 09:33:32 GMT

Shalom etc,

Suggestion.

After doing something in sam, take a look at the commands that it used.

You may see some differences between what you were doing on the command line and what sam does.

options
view SAM log
choose commands only.

This will help you learn and is quite useful when it comes time to create a script.

SEP

Re: Modifying a user questions

Jeff_Traigle — Wed, 30 Nov 2005 09:40:36 GMT

Seemed to work ok for me just now. Are you completely exiting the "Modify User's Security Policies" window? If you don't, the information is not refreshed from the changes you make with modprpw at the command line.