topic Re: password policy in Operating System - HP-UX

password policy

whiteSox — Wed, 30 May 2007 08:45:54 GMT

Hello all u guru's of HP-UX...

I need to enable password restriction on HP machines

1. Password ageing
2. Password length
3. Force password change
Can some one please let me know how can this be done on HP-UX 11.0,11.11,11.23,11.22...?

Thanks in advance for all your help ...

Re: password policy

Patrick Wallek — Wed, 30 May 2007 08:57:15 GMT

The first thing to do is switch to a trusted system. That will enable a lot of what you require.

On top of that you can use features available in the /etc/default/security file. Do a 'man security' for more details. This file does not exist by default and must be created.

Re: password policy

James R. Ferguson — Wed, 30 May 2007 09:13:59 GMT

Hi:

See the manpages for 'usrmod(1M)' and 'security(4)'. Pay attention to the caveats in the 'security' file discussion --- in particular, the MIN_PASSWORD_LENGTH is limited on untrusted systems.

Note also, that trusted mode is deprecated beginning with 11.31. The 'shadow(4)' password file is the preferred path.

By the way, 11.22 is obsolete.

Regards!

...JRF...

Re: password policy

Sp4admin — Wed, 30 May 2007 14:49:42 GMT

Hi,

You can use the /etc/default/security file.

example:
PASSWORD_MIN_UPPER_CASE_CHARS=2
PASSWORD_MIN_LOWER_CASE_CHARS=2
PASSWORD_MIN_DIGIT_CHARS=2
PASSWORD_MIN_SPECIAL_CHARS=2
PASSWORD_HISTORY_DEPTH=10
MIN_PASSWORD_LENGTH=9

sp,

Re: password policy

Robert Fritz — Thu, 31 May 2007 11:12:42 GMT

Also, you should consider standard-mode security extensions. It is available for download for 11.23, and bundled with 11.31.

It gives most of the trusted-mode functionality to users without having to switch to trusted mode, which is being deprecated.

I'd agree with the rest of the folks that trusted mode is your best bet for 11.00, 11.11, and 11.22.