topic Re: using PASSWORD_HISTORY_DEPTH in Operating System - HP-UX

using PASSWORD_HISTORY_DEPTH

rosa maria_1 — Thu, 18 Mar 2010 18:49:58 GMT

Hi,

what kind of implications or issues can be generated if PASSWORD_HISTORY_DEPTH is activated ??

thanks in advance

Re: using PASSWORD_HISTORY_DEPTH

Tim Nelson — Thu, 18 Mar 2010 19:03:35 GMT

only that a password cannot be reused for more than once in X number of changes.

e.g.
PASSWORD_HISTORY_DEPTH=10
must change password 10 times before the same password could be reused.

are you thinking of something more ?

Re: using PASSWORD_HISTORY_DEPTH

rosa maria_1 — Thu, 18 Mar 2010 19:11:51 GMT

well, I have seen that pwhist_* files are generated because of this variable in /tcb/files/auth/system/pwhist, is it correct? in this case root filesystem (/) can be full if this files are not configured correctly in my system, right?
so I though other kind of similar issue can the system has...
Am I right??

Re: using PASSWORD_HISTORY_DEPTH

rosa maria_1 — Thu, 18 Mar 2010 19:14:24 GMT

I forgot to say, this variable is commented in the security file, but I do not the why, so I need to know implications before activate this variable in my system ...

Re: using PASSWORD_HISTORY_DEPTH

Steven E. Protter — Thu, 18 Mar 2010 19:15:10 GMT

Shalom,

Unless you have a HUGE pile of users, 8 digit passwords are not going to fill up the root file system.

SEP

Re: using PASSWORD_HISTORY_DEPTH

Tim Nelson — Thu, 18 Mar 2010 19:26:47 GMT

Good question.

On my DB servers with 5 users and DEPTH=10 and passwd change at 6 times a year I have 32k of histories.

A years worth ~= 6k per user ?

if that math is correct the even with 1000 users with 30day change requirements would only be about 12m, right ?

no worries.

Re: using PASSWORD_HISTORY_DEPTH

rosa maria_1 — Thu, 18 Mar 2010 19:46:32 GMT

Yep, but I do not know if it is the only one problem can I have or can be other like this ...

Re: using PASSWORD_HISTORY_DEPTH

rosa maria_1 — Thu, 18 Mar 2010 22:13:47 GMT

Thanks for your support !!!!

Re: using PASSWORD_HISTORY_DEPTH

Bill Hassell — Fri, 19 Mar 2010 01:06:16 GMT

> Yep, but I do not know if it is the only one problem can I have or can be other like this ...

The biggest problem will be with your users which will be unhappy about not being able to bounce between a couple of favorite passwords. The space required is trivial. The reason it is commented out is like many options in the default security file (in the past, there was no file at all) is that the system administrator should make a conscious decision about security restrictions.

Re: using PASSWORD_HISTORY_DEPTH

rosa maria_1 — Fri, 19 Mar 2010 19:20:10 GMT

you have reason...

Thanks all for you, every answer helps me a lot ...

Re: using PASSWORD_HISTORY_DEPTH

rosa maria_1 — Fri, 19 Mar 2010 19:29:53 GMT

Every answer helps me to validate options and to know implications about security servers.