topic Re: system default values on 11i in Operating System - HP-UX

system default values on 11i

cokster — Tue, 30 Sep 2003 10:24:14 GMT

What are the default settings on 11i (non-trusted mode)for
1. password aging
2. minimum password length
3. # of unsuccessful attempt before the acct. is locked
4. session timeout

If there are no default settings, how can I enforce these security policies? I can't convert to TCB or use pwconv due to the incompatibility with the NIS environment we are using here.

Re: system default values on 11i

Pete Randall — Tue, 30 Sep 2003 10:26:24 GMT

On a non-trusted system, your only options are defined in /etc/default/security. Do a man on security to give you an idea of the capabilities available.

Pete

Re: system default values on 11i

Patrick Wallek — Tue, 30 Sep 2003 10:27:39 GMT

1) None - Can be modified through SAM to set an expiration in weeks, I think.
2) Not sure - Options are available by using the /etc/default/security file. 'man security' for more info.
3) None - Can't do it in non-trusted mode.
4) check the TMOUT environment variable. I don't think it is set by default. Set the TMOUT in /etc/profile or in the users .profile.

Re: system default values on 11i

Ken Hubnik_2 — Tue, 30 Sep 2003 10:31:20 GMT

I have never used it but there is a pluggable module on HPUX. Do a man on pam

man pam

Not sure about using it with NIS

Re: system default values on 11i

Steven E. Protter — Tue, 30 Sep 2003 10:42:23 GMT

You can use the script I'm attaching with modifications to set password aging with the passwd command.

HP-UX is a secureable, not secure out of the box OS. Its up to us admins to lock it down.

The script is a utitity script based on Pete Randall's work.

2. Six characters one as a number is what we have on our 11.00 system and I don't THINK we changed the default.

3. As noted, the TMEOUT variable, which won't work while actually running an application, it will timeout ssh/telnet sessions though.

4. ??

Re: system default values on 11i

cokster — Tue, 30 Sep 2003 10:51:46 GMT

steven, does your script work with NIS?

Re: system default values on 11i

Pete Randall — Tue, 30 Sep 2003 11:09:33 GMT

From "man useradd":

This command is aware of NIS user and group entries. Only local users
and groups may be modified with this command. Attempts to modify an
NIS user or group will result in an error.

As for the script, my admittedly pitiful scripting skills can't figure out what it does!

Pete

Re: system default values on 11i

Pete Randall — Tue, 30 Sep 2003 11:15:35 GMT

I think the script has the pertinent line commented out:
# passwd -r file -n $MINDAYS -x $MAXDAYS $user

If you look at "man passwd", you'll see that there is a "passwd -r nis" option which at least implies that it should work with NIS.

Pete