topic Re: Regarding account lock in Operating System - HP-UX

Regarding account lock

Sridhar R — Tue, 26 Feb 2008 10:20:55 GMT

Hi,

I want the user's account to get locked if they are trying to login after 3 wrong attempts.

(Note: Right now, user can login the nth time even if he does n-1 wrong attempts)

Kindly tell me how to do this??

And also i want to know about unlocking the account without resetting to a new password !!

Kindly help and give a solution for this!!

Thanks in Advance!!

Sridhar

Re: Regarding account lock

Anshumali — Tue, 26 Feb 2008 10:35:18 GMT

1. trusted system
2. /usr/lbin/modprpw -k user_name

Re: Regarding account lock

likid0 — Tue, 26 Feb 2008 10:40:43 GMT

Yes, you must check that you are runing a trusted system, if its a trusted system you will have a /tcb directory.

Here you can see the config of the server:

/tcb/files/auth/system# cat default
default:\
:d_name=default:\
:d_boot_authenticate@:\
:u_pwd=*:\
:u_owner=root:u_auditflag#-1:\
:u_minchg#0:u_maxlen#16:u_exp#2419200:u_life#2592000:\
:u_llogin#0:u_pw_expire_warning#1814400:u_pswduser=root:u_pickpw:\
:u_genpwd:u_restrict@:u_nullpw@:u_genchars:\
:u_genletters:u_suclog#0:u_unsuclog#0:u_maxtries#3:\
:u_lock:\
:t_logdelay#2:t_maxtries#10:t_login_timeout#0:\
:chkent:

But i would suggest using sam, to change these settings.

Re: Regarding account lock

Sridhar R — Tue, 26 Feb 2008 10:49:00 GMT

Hi,

Thnx for the reply.

i dont find any /tcb directory.

Re: Regarding account lock

likid0 — Tue, 26 Feb 2008 11:05:01 GMT

You can convert to trusted mode from SAM or on command line.

command line- /etc/tsconvert -c

All accounts will expire and will be prompted for new password. So immediatley after you do /etc/tsconvert -c, do
/usr/lbin/modprpw -V

Rather do
/etc/tsconver -c;/usr/lbin/modprpw -V

Re: Regarding account lock

dinoside — Tue, 26 Feb 2008 21:44:13 GMT

if untrust the system, tsconvert -r

Re: Regarding account lock

Robert Fritz — Wed, 27 Feb 2008 00:24:27 GMT

Also note that trusted mode is deprecated in 11.31 in favor of the Standard Mode security extensions. (discontinued in 11.41)

Using that, you can (in 11.31, or with the SMSE download in 11.23) use the setting AUTH_MAXTRIES in /etc/default/security to set this, or per-user, using the userdb command.

This does NOT require the transition to trusted mode.

-Robert

Re: Regarding account lock

Sridhar R — Wed, 27 Feb 2008 06:26:43 GMT

Hi Orange,

I did whatever u said. I think the system is in trusted mode right now.

And now i can see the /tcb directory.

I get the default(/tcb/files/auth/system) file to be:

vorap101#cat default
default:\
:d_name=default:\
:d_boot_authenticate@:\
:u_pwd=*:\
:u_owner=root:u_auditflag#-1:\
:u_minchg#0:u_maxlen#8:u_exp#15724800:u_life#16934400:\
:u_pw_expire_warning#604800:u_pswduser=root:u_pickpw:u_genpwd:\
:u_restrict@:u_nullpw@:u_genchars@:u_genletters:\
:u_suclog#0:u_unsuclog#0:u_maxtries#3:u_lock:\
:\
:t_logdelay#2:t_maxtries#10:t_login_timeout#0:\
:chkent:

What should i make change in this file so that my requirement fulfills !!

And also i want tp know how to change it to non-trusted mode again?? Will i get any problem if i leave it as such in trusted mode??

Thanks !

Re: Regarding account lock

likid0 — Wed, 27 Feb 2008 08:49:15 GMT

Hy,

There is no problem with the system in trusted mode, it should be in trusted mode.

as the default stands you have what you want, after 3 wrong attempts the server blocks the user.

u_maxtries#3

database u_maxtries:

Set Maximum Unsuccessful Login tries allowed.
0 = infinite.

to unlock the user, without changing passwd:

/usr/lbin/modprpw -k user_name

have a look at man modprpw

Re: Regarding account lock

Sridhar R — Wed, 27 Feb 2008 09:35:10 GMT

Hi,

Thanks that's working!

But, is there any direct command to check whether the system is in trusted or un-trusted mode?

By any chance, is it possible to revert back to un-trusted mode?

If yes, kindly let me know!!

Thanks!!

Re: Regarding account lock

Anshumali — Wed, 27 Feb 2008 09:46:25 GMT

1. Actually Many
---run any command which is a trusted system only command, getprpw, modprpw
----- check for /tcb

2. tsconvert -r

Re: Regarding account lock

titu — Wed, 27 Feb 2008 10:45:14 GMT

hi Sridhar,

Please check with this command:

#usr/lbin/modprpw -k root

This command will show whether the system is trusted system or not ?

Re: Regarding account lock

titu — Wed, 27 Feb 2008 10:59:36 GMT

Hi Sridhar ,

you can go to /etc/deafult/security and
put a parameter :

#AUTH_MAXTRIES= no. of tries-1

it will lock the userid after more no. of tries mentioned here.

Re: Regarding account lock

Sridhar R — Wed, 27 Feb 2008 11:00:29 GMT

Thanks !