topic Account Disabled in Operating System - HP-UX

Account Disabled

ladoo_1 — Tue, 13 May 2008 16:49:32 GMT

Hi, I have user complaining that there accounts are getting disabled with out any warning. we are running all the systems in the trusted mode and the os is 11.11 and 11.23 hp-ux we do have the ageing enabled .can some one please explain why the users are not getting warning so they can reset there own password and there account does not get disabled.

Re: Account Disabled

Patrick Wallek — Tue, 13 May 2008 17:31:24 GMT

You need to check the accounts and see why the accounts are getting disabled.

For the users in question issue the command:

# /usr/lbin/getprpw -m lockout
(where is the appropriate user id)

This will return something like:

lockout=0100000

A string of all 0's (lockout=0000000) means the account is unlocked. A '1' in any position indicates the account is locked. Each position is a different lock reason.

You now need to look at the man page for getprpw, go to the lockout section and see what each position in the above string means.

That will tell you if they are typing their password wrong too many times, or if it is password age, or some other reason.

Re: Account Disabled

Steven E. Protter — Tue, 13 May 2008 17:40:36 GMT

Shalom,

There is a warning, you just aren't getting it because its logged in /var/adm/syslog/syslog.log

If you need a notice, you can look there or at the output from the lastb command.

SEP

Re: Account Disabled

ladoo_1 — Tue, 13 May 2008 17:47:48 GMT

How can i make sure that all users are getting the warning that is set to 21 days .But they are not getting it .

Re: Account Disabled

ladoo_1 — Tue, 13 May 2008 18:17:22 GMT

what run the lastb command i see bunch of ..
# lastb |grep -i id

id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
id ssh:notty
i don't know what does ssh:notty mean ??

Re: Account Disabled

Tim Nelson — Tue, 13 May 2008 18:55:41 GMT

modprpw -m expwarn=21 username

or modify the system default
modprdef -m expwarn=14

and set everyone to default

modprpw -m expwarn=-1 username

Re: Account Disabled

Tim Nelson — Tue, 13 May 2008 18:57:41 GMT

BTW,

You have assigned points to 0 of 39 responses to your questions

Awarding points is a great way to say thanks for the assistance.

Just click on the pull down next to each response, pick an appropriate number and then click submit.