topic Re: Need to get password Attributes in Operating System - HP-UX

Need to get password Attributes

Vidhya B — Thu, 02 Jun 2011 02:07:24 GMT

Hi all,

Kindly help me how to get the followin following attributes through a command.
I can understand that I can view them in /etc/default/security file. But I need to find them through command.

PASSWORD_HISTORY_DEPTH
ABORT_LOGIN_ON_MISSING_HOMEDIR
MIN_PASSWORD_LENGTH
PASSWORD_MIN_UPPER_CASE_CHARS
PASSWORD_MIN_DIGIT_CHARS
PASSWORD_MIN_SPECIAL_CHARS
PASSWORD_MAXDAYS
PASSWORD_MINDAYS
PASSWORD_WARNDAYS

Thanks in Advance!!!

Re: Need to get password Attributes

Steven Schweda — Thu, 02 Jun 2011 02:31:50 GMT

> [...] But I need to find them through
> command.

cat /etc/default/security

What, exactly, do you mean? What, exactly,
does "find them through command" mean to you?
What, exactly, would you like to do?

grep PASSWORD_HISTORY_DEPTH /etc/default/security

There it is. Now what?

Re: Need to get password Attributes

Vidhya B — Thu, 02 Jun 2011 02:47:35 GMT

Hi,

I can understand that I can grep.

I am writing a script to review hardening policies.
If I grep from that file and then compare values, it will make it length.

In order to find the umask, we will use the command umask. In the similar way if there is any specific command(s) which gives me the output for the above attributes.

For eg regarding PASSWORD_HISTORY_DEPTH, If my PASSWORD_HISTORY_DEPTH is 5, then if I am able to get a command which gives me this value directly, I will be able to assign it to a variable and compare with the actual hardening policy.
This will reduce time and length of the script.

Please help.

Re: Need to get password Attributes

Steven Schweda — Thu, 02 Jun 2011 03:20:02 GMT

> I am writing a script [...]

Should I have known that?

> [...] assign it to a variable [...]

Should I have known that?

> I can understand that I can grep.

That's good, but you seem to need to learn
some shell script basics. For example, ``
or $() can be used to work with the output of
a command (or pipeline).

phd=` grep PASSWORD_HISTORY_DEPTH \
/etc/default/security | \
sed -e 's/.*=//' `

echo $phd

Interactively:

dyi # phd=` grep PASSWORD_HISTORY_DEPTH \
> /etc/default/security | \
> sed -e 's/.*=//' `

dyi # echo $phd
4

Re: Need to get password Attributes

Vidhya B — Thu, 02 Jun 2011 04:10:46 GMT

Hi,

Actually I have another issue even.

There are few entries in that file which is already commented.

So If two PASSWORD_HISTORY_DEPTH(one commented) exist in the file, then that will cause problem again.

Re: Need to get password Attributes

Duncan Edmonstone — Thu, 02 Jun 2011 05:57:25 GMT

So further judicious use of the sed command should get rid of any comment lines (and blank lines):

SO you had:

phd=` grep PASSWORD_HISTORY_DEPTH \
/etc/default/security | \
sed -e 's/.*=//' `

echo $phd

That could become:

phd=` sed -e 's/#.*//g' -e '/^$/d' \
/etc/default/security | \
grep PASSWORD_HISTORY_DEPTH | \
sed -e 's/.*=//' `

echo $phd

You could probably make this more efficient by combining those sed calls into one, but I've left them seperate so you can get a feel for what is happening here...

HTH

Duncan

Re: Need to get password Attributes

Steven Schweda — Thu, 02 Jun 2011 15:06:48 GMT

> [...] (and blank lines):

How easy is it to find a blank line which
also has the desired keyword on it?

Re: Need to get password Attributes

Duncan Edmonstone — Thu, 02 Jun 2011 16:39:33 GMT

>> How easy is it to find a blank line which
>> also has the desired keyword on it?

Ha! I take your point - I guess I was using it out of context - I'm in the habit of always putting those two sed constructs together as I'm ass-u-me(ing) the output will be read by a person rather than another command in a pipeline...

for example... I don't like the output of:

swlist -l fileset -a state

I much prefer to look at :

swlist -l fileset -a state | sed -e 's/#.*//g' -e '/^$/d'

So I left it in in this case cos I thought the original poster might be curious enough to deconstruct the pipeline, and it would show him a cleaner output...

HTH

Duncan

Re: Need to get password Attributes

Steven Schweda — Thu, 02 Jun 2011 20:13:03 GMT

> [...] I thought the original poster might
> be curious enough [...]

I wish, but there's not much evidence for it.

Re: Need to get password Attributes

Dan Bolton — Fri, 03 Jun 2011 14:45:34 GMT

Or you could reject the comment lines by using:

phd=` grep ^PASSWORD_HISTORY_DEPTH /etc/default/security ...

thus anchoring the expression to the beginning of the line. ("man 5 regexp" if you need further info).

-db

Re: Need to get password Attributes

Duncan Edmonstone — Mon, 06 Jun 2011 06:28:16 GMT

Dan,

>> phd=` grep ^PASSWORD_HISTORY_DEPTH /etc/default/security ...

Fine, except there is no actual requirement for the keyword to appear in column 1 , or even for a comment line to have a "#" in column 1 of the file, so there could be some white space in there... maybe:

phd=$( grep "^[[:space:]]*PASSWORD_HISTORY_DEPTH=" /etc/default/security | sed -e 's/.*=//' )

All goes to show there are many ways to do this, and each way requires you to think carefully about the input...

HTH

Duncan

Re: Need to get password Attributes

vishnu.khandare — Tue, 07 Jun 2011 10:53:30 GMT

Hi Vidhya B,

for ur query i guess u want to write a script to get the said parmeters.

R u ware of the command "logins -aox"

Please check its man page even this command give the output of all the users with, last passwd reset, PASSWORD_MAXDAYS
PASSWORD_MINDAYS
PASSWORD_WARNDAYS

and many more check its man page for more details.

Hope this solves ur query.

Thanks & Regards
Vishnu Khandare