topic Allow Only Super-User To Change Password in Operating System - HP-UX

Allow Only Super-User To Change Password

RogerVI — Mon, 23 Feb 2009 21:14:18 GMT

I want to set up the users that do not have the ability to change their own passwords. I do this via sam with the 'Allow only Super-User to change password'.
But when I change the password with the command "passwd user", it reverts back to the 'Normal Behaviour' option.

I'm on HP-UX 11.11. My system is not trusted

Thanks in advance

Re: Allow Only Super-User To Change Password

OldSchool — Mon, 23 Feb 2009 21:23:32 GMT

see this post:

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1314064

why would you want to do such a thing? not only does it cause a security breach, it makes more work for somebody.

Re: Allow Only Super-User To Change Password

Dennis Handly — Mon, 23 Feb 2009 21:57:47 GMT

>when I change the password with the command "passwd user", it reverts back to the 'Normal Behaviour' option.

You can "fix" this by using vipw(1m) by adding ",./" to the end of the passwd field. I have no idea why there isn't an option in passwd(1) to do that.

Re: Allow Only Super-User To Change Password

RogerVI — Mon, 23 Feb 2009 23:38:12 GMT

Dear Dennis:

Could you help me how to add those characters using a script ?

This is due to I must do the change for multiple users and periodically

Re: Allow Only Super-User To Change Password

Dennis Handly — Wed, 25 Feb 2009 04:07:27 GMT

Unfortunately while sam will modify the password options, it doesn't remember superuser only when you change the password.

>Could you help me how to add those characters using a script?

This would be very dangerous if anything goes wrong. Do you want to add them to any entry in /etc/passwd, or to all but certain ones?
awk -F: '
BEGIN { OFS = ":" }
{
password = $2
if ($1 != "root" && $1 != "+" &&
password != "*" && index(password, ",") == 0) {
password = password ",./"
}
print $1, password, $3, $4, $5, $6, $7
} ' /etc/passwd > passwd.new

Re: Allow Only Super-User To Change Password

RogerVI — Wed, 25 Feb 2009 15:47:44 GMT

The /etc/passwd file has 800 lines aprox.
I need to add the characters ",./" to the accounts based on a file. For example, if this file is called accounts.txt (aprox. 20 lines):

user1
user2
..
user20

Then I want to add the characters to accounts user1, user2,..user20.

Re: Allow Only Super-User To Change Password

Dennis Handly — Thu, 26 Feb 2009 03:44:36 GMT

>I need to add the characters ",./" to the accounts based on a file

Assuming the name is user_file:
awk -F: -vusers=user_file '
BEGIN {
while (getline < users > 0)
name[$0] = 1 # save for checking
close(users)
OFS = ":"
}
{
password = $2
if ($1 != "root" && $1 != "+" &&
password != "*" && index(password, ",") == 0 && name[$1]) {
password = password ",./"
}
print $1, password, $3, $4, $5, $6, $7
} ' /etc/passwd > passwd.new

Re: Allow Only Super-User To Change Password

Patrick Wallek — Thu, 26 Feb 2009 04:41:05 GMT

I'm with OldSchool here. I'm still thoroughly confused as to why you don't want your users to change their own passwords, especially with 800+ accounts.

Are you trying to justify your job?

Re: Allow Only Super-User To Change Password

VK2COT — Thu, 26 Feb 2009 05:11:14 GMT

Hello,

A friend of mine worked for a major bank here in Australia last year. She told me that one
of the world-largest outsourcing companies
charged bank around 400 Australian dollars for every password reset :)

Nice and easy money. And "very hard earned".

Cheers,

VK2COT

Re: Allow Only Super-User To Change Password

RogerVI — Thu, 26 Feb 2009 05:20:06 GMT

I have a proprietary security platform, in which the validation is that the password of Unix system should be equal to the password of the propietary security platform.
Actually, users (he or she) don't log on Unix. The connection is done by applications, not directly by users. These users have access to certains parts of the applications according your job nature and logged with a personal account.
For audit reasons, the Unix password must be changed periodically, and only the superuser should be able to do it
Dennis, Thank you very much for your help.