topic Re: How to determine number of days left till password expire? in Operating System - HP-UX

How to determine number of days left till password expire?

Michael Kan — Fri, 05 Apr 2002 07:43:54 GMT

I have remote applications connecting to my server using it's own dedicated username and password. I have set it to expire after 84 days. But each time it expires, my application will have problems and I wouldn't know it till someone calls me up with a complain. Is there any command to check the number of remaining days before password expiration? I know the command passwd -s shows the date of setting the password aging, but there's just too many to check manually. I'm actually trying to create a script to check the password expiration periodically. Any hints or helps is much appreciated.

Re: How to determine number of days left till password expire?

Rainer von Bongartz — Fri, 05 Apr 2002 07:58:20 GMT

You could do this writing a small C program using the system call
getprwent() . (see man )

this call returns a struct pr_passwd which holds all informations you want

I use this to generate a mail warning 5 days befor passwords expire

Regards
rainer

Re: How to determine number of days left till password expire?

Systeemingenieurs Infoc — Fri, 05 Apr 2002 08:02:41 GMT

I think one can play with the
/tcb/files/auth/system/default
and the
/tcb/files/auth/u/user1
files

I think the needed tags are u_exp# and
u_succhg#. If you add these to, and convert
the date, you should be able to construct the
expiration time (i guess).

Hein Coulier

Re: How to determine number of days left till password expire?

Deepak Extross — Fri, 05 Apr 2002 08:03:59 GMT

Hi,
Doesn't "passwd -s -a" give you what you need?

Re: How to determine number of days left till password expire?

Rainer von Bongartz — Fri, 05 Apr 2002 08:09:26 GMT

sorry; the call is

getprpwent().

Regards
Rainer

Re: How to determine number of days left till password expire?

Michael Kan — Fri, 05 Apr 2002 08:43:42 GMT

Rainer,Systeemingenieurs Infoco : Errr my system is not a trusted system. Am I still able to use the getprwent()?
And I am also no good in C. Any suggestion?

Deepak : The passwd only gives me the date of enabling the aging of passwords.

Re: How to determine number of days left till password expire?

Rainer von Bongartz — Fri, 05 Apr 2002 08:53:28 GMT

Sorry, as the manual says:

getprpwent, getprpwuid, gettprpwaid, and getprpwnam each returns a
pointer to a pr_passwd structure containing the broken-out fields of a
line in the protected password database

, so it's only valid for trusted systems

Regards
Rainer

Re: How to determine number of days left till password expire?

Michael Tully — Fri, 05 Apr 2002 09:03:32 GMT

Hi,

You can only set this up within the
confines of a trusted system.
Once setup this type of configuration
can be set per user. You can set up
global rules for most users, and
exceptions for special users should you
wish. These facilities are not available
without the system being setup as
trusted.

If you have a test system, set it as
trusted and check it out. Using 'sam'
is the best way to start.

Cheers
~Michael~

Re: How to determine number of days left till password expire?

Mark Greene_1 — Fri, 05 Apr 2002 14:49:39 GMT

the expiration information appears to be stored in one of the files in /var/spool/pwgr. they are all binary files, so if you don't do C, I'm not sure how you are going to extract the information. pwd_name_hash.pag or pwd_uid_hash.pag appear to be the likely suspects from what I can gather using cat -v. however, they are both the same size, so they may be mirrored versions of each other, or at least have the same fixed format.

a string search of the man pages does not return any references to /var/spool/pwgr (no big surprise), but you may find a reference to the files in a security doc or white paper if you search hp's web site.

HTH
mark

Re: How to determine number of days left till password expire?

A. Clay Stephenson — Fri, 05 Apr 2002 17:37:09 GMT

Hi Micheal:

You were fortunate in that I already had a Perl script to do this. Note that in a non-trusted environment the expiration is encoded as the number of weeks left in base64. Man 4 passwd for details.

If you execute pwwarn.pl user1 [user2 ...], it will output a line for each user like this
user1 4096
user2 2
user3 0

Where the number is the number of weeks left. 4096 (64 * 64) indicates that this passwd does not expire.

Regards, Clay

Re: How to determine number of days left till password expire?

Michael Kan — Sat, 06 Apr 2002 01:54:42 GMT

Hi A. clay Stephenson: How to I use a Perl script. I have only used Shell scripts ?
I don't know how to run the script that you created... Pls help.

Re: How to determine number of days left till password expire?

A. Clay Stephenson — Sat, 06 Apr 2002 20:18:20 GMT

Depending upon the version of HP-UX that you are running, you have a very old version of Perl or the newer 5.6 version. If you are running 10.x, you have an old, obsolete version and you should install a newer version of Perl from any of the HP-UX Porting Centres.
e.g. http://hpux.cs.utah.edu/hppd/hpux/Languages/perl-5.6.1/

Execute perl -v to display your version.

The Perl package is installed like any package using swinstall. Typically, you symbolically link /opt/perl5/bin/perl to /usr/bin/perl.

After that you simply execute 'pwwarn.pl tom dick harry' just as you would a shell script. The 'shebang' statement #!/usr/bin/perl automatically causes the shell to invoke perl or your can execute explicitly like 'perl pwwarn.pl tom dick harry'.

Re: How to determine number of days left till password expire?

Michael Kan — Tue, 16 Apr 2002 09:00:43 GMT

Hi Rainer von Bongartz :
Can I request you to give me the C program ?? Because we will be converting our system into trusted later on. Really appreciate it.
Thank you.

Re: How to determine number of days left till password expire?

Rainer von Bongartz — Tue, 16 Apr 2002 12:16:32 GMT

Michael,

find the small C-program as attachment.

Change it to your needs but dont't blame me for anything.

Regards
Rainer

Re: How to determine number of days left till password expire?

Michael Kan — Tue, 16 Apr 2002 23:26:10 GMT

Thank you very much, Rainer von Bongartz.

Re: How to determine number of days left till password expire?

Michael Kan — Thu, 18 Apr 2002 06:03:34 GMT

Hi Rainer von Bongartz,

I get a coredump when running the executable. I compiled it with # cc -o exe source.c
Then when I run the exe, i get this msg -->
/usr/lib/dld.sl: Unresolved symbol: getprpwent (code) from ./pwd_check
Abort(coredump)

Anyone know why?
Thank you.

Re: How to determine number of days left till password expire?

Rod McLean — Wed, 08 May 2002 06:04:20 GMT

Michael,

try compiling with -lsec

cc -o exe source.c -lsec

It will probably only work on a trusted system

Rod

Re: How to determine number of days left till password expire?

Michael Kan — Wed, 08 May 2002 06:43:28 GMT

Thank you for your answers.

I actually have downloaded another C program from the internet to calculate the number of days between two dates. From there I just write a shell script to use the program to check the number of days before the password expires.