topic Re: restrict trivial password in Operating System - HP-UX

restrict trivial password

unixadmin_1 — Tue, 06 Jan 2009 13:29:41 GMT

any solution for this issuementioned below:

Trivial passwords were still allowed. Fourteen users were found to have weak passwords. Weak passwords increase the risk of unauthorised access being gained to the system and information resources.

Re: restrict trivial password

Ganesan R — Tue, 06 Jan 2009 13:35:27 GMT

Hi Unixadmin,

Weak password is big security breach always. You can force the user to set complex passwords by many ways.

One option is configure /etc/default/security
file to have complex password for all the user. See man security for more details.

Other option is convert the system into trusted. You can have so many features in trusted system including complex passwords.

Hope this helps

Re: restrict trivial password

Pete Randall — Tue, 06 Jan 2009 13:36:06 GMT

>Trivial passwords were still allowed.
Don't allow them.

>Fourteen users were found to have weak passwords.
Make them change them.

>Weak passwords increase the risk of unauthorised access being gained to the system and information resources.
True.

Pete

Re: restrict trivial password

change owners — Wed, 07 Jan 2009 08:26:58 GMT

even than after is there any command which restricts trivial passwords...pls

Re: restrict trivial password

unixadmin_1 — Fri, 16 Jan 2009 11:11:16 GMT

How do we get list of trivial passwords is there any shell script that runs on the system to get trivial passwords in one shot..please let me know its a urgent issue which should be resolved by tomm.

Re: restrict trivial password

OldSchool — Fri, 16 Jan 2009 13:21:59 GMT

"Fourteen users were found to have weak passwords."

unix *doesn't* know they were "weak", so somebody ran a password cracker to attempt to figure this out. if they didn't supply the list, then either you will have to run the same tool to generate it yourself, or you will have to force everyone to update their passwords.

"man passwd" for details on how to do that. you can enforce password construction rules. I suggest you put the rules in place then force everyone to change there password.

"man security" (i believe) will provide more details on the rules / files needed.

Re: restrict trivial password

Johnson Punniyalingam — Fri, 16 Jan 2009 16:17:10 GMT

Hi Unixadmin.

Only best way is to track them is by apply some changes to passwd length, by editing /etc/default/security

MIN_PASSWORD_LENGTH=8

Thanks,
Johnson

Re: restrict trivial password

unixadmin_1 — Fri, 23 Jan 2009 09:13:17 GMT

Ok got it