topic Re: Creating a administrative— function (e.g. change password in Operating System - HP-UX

Creating a administrative— function (e.g. change password

Dan Walker — Mon, 22 Oct 2007 15:37:55 GMT

I need to create a account where this function can only change passwords nothing else for a help desk

Re: Creating a administrative— function (e.g. change password

Tim Nelson — Mon, 22 Oct 2007 15:58:22 GMT

Once upon a time we ran into the same dilemma.

We addressed it as follows.

We created a script that resticted the password changes with an exclusion list.. i.e. root account, admin accounts, others,

Create a SAM action to execute your script as root.

Create each help disk user a unix account, cuz you know that gang logins are bad.

Give each help desk user access to restricted sam.

Be sure to triple test the security of the script.

Re: Creating a administrative— function (e.g. change password

A. Clay Stephenson — Mon, 22 Oct 2007 15:59:24 GMT

You can do this with a restricted sam session but perhaps the best way to implement this function is via sudo.

Re: Creating a administrative— function (e.g. change password

whiteknight — Mon, 22 Oct 2007 21:16:43 GMT

Dan,

You can install RBAC, HPUX 's sudo equivalent.

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=AccessControl

To assign specific role.

WK