topic Re: /etc/default/security file on an untrusted system in Operating System - HP-UX

/etc/default/security file on an untrusted system

Michael Campbell — Tue, 10 Sep 2002 07:35:37 GMT

Folks

Can the following parameters be set in the /etc/default/security file on an untrusted system?

PASSWORD_HISTORY_DEPTH
PASSWORD_MIN_UPPER_CASE_CHARS
PASSWORD_MIN_LOWER_CASE_CHARS
PASSWORD_MIN_DIGIT_CHARS
PASSWORD_MIN_SPECIAL_CHARS

We don't want to convert to trusted but we have installed the PHCO_26089 patch.

Any help appreciated.

Michael

Re: /etc/default/security file on an untrusted system

Darren Prior — Tue, 10 Sep 2002 08:46:52 GMT

Hi Michael,

Yes you can use those functions on an untrusted system. Please note that according to the patch text:

"These parameters have effect only when a password is changed. On untrusted systems, these parameters do not apply to the root user. The file /etc/default/security should be owned by root and have 0644 permissions."

Root can still override the rules when changing a user password.

If you attempt to change a password to something that doesn't comply with the rules you'll see a message like:

"The password entered is not valid. Valid password must contains at least:

2 upper case character(s)
3 lower case character(s)
etc.."

regards,

Darren.

Re: /etc/default/security file on an untrusted system

Pete Randall — Tue, 10 Sep 2002 09:17:15 GMT

Michael,

Absolutely! We've been using the SU_ROOT_GROUP feature on untrusted systems for quite some time now.

Enjoy,
Pete

Re: /etc/default/security file on an untrusted system

doug hosking — Wed, 11 Sep 2002 09:08:57 GMT

All on your list EXCEPT the PASSWORD_HISTORY_DEPTH should work fine when not in trusted mode. That one won't work because the password history info is stored under /tcb, which doesn't exist except in trusted mode.