topic Re: User Account Features in Operating System - HP-UX

User Account Features

G V R Shankar — Wed, 22 Apr 2009 12:18:50 GMT

Hi All,

Could you please help me how can I acheive the following in HPUx, without any 3rd party tools.

1. After 180 days of inactivity the account should be blocked. : I am still looking for exact number
2. After 400 days of inactivity the account should be removed, logged and maintain in another data base as a record history : I am still looking for exact number

For the above 2 points, I couldn't find anything in TCB, /etc/default/security and /etc/pam.conf

Where can I get more information on the following library files related to PAM.

/usr/lib/hpux32/libpam.so.1
/usr/lib/hpux64/libpam.so.1
/usr/lib/libpam.1
/usr/lib/pa20_64/libpam.1

These libraries are being referenced in /etc/pam.conf

I am not sure what are defined in these library files.

Your help is greatly appriciated.

Thank You.

Ravi.

Re: User Account Features

Pete Randall — Wed, 22 Apr 2009 12:22:04 GMT

Write a cron script using the finger command to extract days of inactivity and then lock/remove the account manually.

Pete

Re: User Account Features

Ganesan R — Wed, 22 Apr 2009 12:31:54 GMT

Hi,

>>1. After 180 days of inactivity the account should be blocked. : I am still looking for exact number<<

This you can achieve by converting the system into trusted and apply the settings globally(all the users)

>>2. After 400 days of inactivity the account should be removed, logged and maintain in another data base as a record history :<<

I donot have any info to achieve this. But you can schedule a shell script in cron to do this based on the output from getprpw or other commands.

Re: User Account Features

TTr — Wed, 22 Apr 2009 12:32:38 GMT

Task 1 is set up in TCB using the INACTIVITY_MAXDAYS setting. Check out the TCB fields and settings in

http://docs.hp.com/en/5992-3387/apas03.html?jumpid=reg_R1002_USEN

http://docs.hp.com/en/B2355-60130/security.4.html

You have to perform task 2 yourself via a script.

For PAM check out the man page http://docs.hp.com/en/B2355-60130/pam.3.html
and all the "see also" pages at the bottom.

Re: User Account Features

UVK_1 — Wed, 22 Apr 2009 12:41:35 GMT

Greetings !!

Use the switch '-f 180' while creating the user using useradd that will give the functionality of disabling the user if no activity for 180 days.

Deleting can be achieved using a cron script as Pete said. Use the combination of finger and userdel.

Cheers,
uvk

Re: User Account Features

G V R Shankar — Wed, 22 Apr 2009 14:35:53 GMT

Hi All,

Thank you for the prompt responses.

Hi Ganesan,

I request you to me to the exact option in SAM.

Hi TTr,

All my systems are trusted. As per the URL http://docs.hp.com/en/B2355-60130/security.4.html
INACTIVITY_MAXDAYS is not applicable to Trusted Systems.

Hi UVK,

I have set it for one of the users using usermod -f 180 username. Where can I see it. getprpw doesn't show any information.

Cheers,

Ravi.

Re: User Account Features

G V R Shankar — Thu, 23 Apr 2009 11:02:41 GMT

Hi,

Could you please reply to my questions.

Ravi.

Re: User Account Features

Mark Fenton — Thu, 23 Apr 2009 23:05:57 GMT

in /etc/default, you could add a 'useradd' file with a line like:

INACT 180

and then by default, when a new account is created, the lockout will be set to 180 days of inactivity.

There's also a switch for EXPIRE, but I think that just sets how many days before deactivating the account (regardless of activity).

Re: User Account Features

Ganesan R — Fri, 24 Apr 2009 08:05:11 GMT

Hi Ravi,

>>>Hi Ganesan,

I request you to me to the exact option in SAM. <<<

Hope you are asking the trusted configuration options in SAM

SAM -> Auditing and Security -> System Security Policies -> General User Account Policies ->Enable Account Policies -> set the value here

Maximum Inactive Time (days):180

Hope this helps

Re: User Account Features

G V R Shankar — Fri, 24 Apr 2009 11:49:44 GMT

Thank you Ganesan. I think I have overlooked General System policies.

Re: User Account Features

G V R Shankar — Mon, 27 Apr 2009 09:42:45 GMT

It is in the url