topic Re: Multiple user password change in Operating System - HP-UX

Multiple user password change

Jakes Louw — Wed, 01 Oct 2003 03:17:29 GMT

Hi all
I'd be the first to admit that I'm not a good scripter, in fact I try an get by with the least script writing possible (I grew up on mainframes, and UNIX scripting has just never clicked with me).
Anyway: I often need to change multiple user passwords at a time, sometimes up to 30. These are usually for classrooms, testing, sandbox groups, etc, so we usually set the password to a generic and let the user change it again later.
Do any of you have a nifty way of feeding PASSWD a password?
I would normally have to do a "for x in a b c d ....do..passwd $x...done" and then go the whole laborious hog of picking a password type (Trusted converted server), then a password and confirmation.
Any ideas?

Re: Multiple user password change

Thierry Poels_1 — Wed, 01 Oct 2003 04:09:15 GMT

hi,

if you want to set a password for a group of people you will need to combine "passwd" with "expect".

But as you mentioned classrooms, testing, sandbox, ... maybe you can just remove the passwords?

passwd -d -f username : to delete password and force a new one at next logon.

passwd -l username : to lock accounts when not needed.

good luck,
Thierry.

Re: Multiple user password change

Jakes Louw — Wed, 01 Oct 2003 04:12:37 GMT

Hi Thierry

I'll play with the the -d -l options, maybe that's what could work in most cases.
Explain the "expect" thing to me?

Re: Multiple user password change

Thierry Poels_1 — Wed, 01 Oct 2003 04:18:42 GMT

expect is a program that talks to other interactive programs. You can script it to wait for "New password:" and "Re-enter new password:" and send the new password accordingly.

If you browse around (ITRC, google) you will probably find some examples.

best regards,
Thierry.

Re: Multiple user password change

Jakes Louw — Wed, 01 Oct 2003 04:24:51 GMT

Thanks. You get some more points for that ;->

Re: Multiple user password change

Thierry Poels_1 — Wed, 01 Oct 2003 04:27:33 GMT

hi again,

BTW if the users are named more or less equal, you can shorten the script a lot, and don't have to bother if users are added.

instead of "for x in a b c d e ........"

for x in $(grep "Classroom Student" /etc/passwd |cud -d":" -f1)
do
...
done

regards,
Thierry.

Re: Multiple user password change

Myles McManus — Wed, 01 Oct 2003 06:23:24 GMT

Keep these users at the end of the passwd file. Keep a seperate text file with the default users settings like this:
name:passwdstring:gid:uid
name2:passwdstring:gid:uid
name3:passwdstring:gid:uid

etc.

As long as the passwd string is the same. then the passwd will be too. You can just paste this onto the end of /etc/passwd whenever you need 20 temporary users or so. If they are temp users then its ok to give them logins like login1, login2 etc. And there's no real reason why they can't be re-used.

Re: Multiple user password change

Jakes Louw — Wed, 01 Oct 2003 06:29:21 GMT

Hi Myles
That doesn't work very well once the server is trusted.

Re: Multiple user password change

Rita C Workman — Wed, 01 Oct 2003 06:46:34 GMT

I needed to something similar awhile back and with the help of a great guy from HP, we got this script worked out.
In my case key was that all the users had login names as 'all caps', but you could change it to whatever will work for you...

Hope it helps,
Rgrds,
Rita

Re: Multiple user password change

Rita C Workman — Wed, 01 Oct 2003 06:54:36 GMT

Hmmm...just tried to check and make sure the attachment is ok, but for some reason I can't open it from above. Maybe you can.
Just in case here's the script again:

#!/bin/sh
#
#
########################
# This script is to mass change
# passwords and set account
# to force user to change p/w
# at next login..
# Written by Sven Liessem HP.com
# and Rita Workman
# May, 2002
#
# YOU MUST FIRST GET THE
# ENCRYPTED PASSWORD VALUE
# FOR NEWPASS VALUE
#
#
# I run this script and output
# to another file & then
# lay file over /etc/passwd
# ex: ./scripts/passwd_mass_chg.sh > /etc/passwd.new
#########################
newpass="d.Cm86XRE3oH6,3..."
cat /etc/passwd | while read line
do
echo $line | grep -q '^[A-Z][A-Z]*:[^:]*,3\.\.\.:'
if [ $? -eq 0 ]
then
usrname=`echo $line | cut -d: -f1`
therest=`echo $line | cut -d: -f 3-`
echo $usrname:$newpass:$therest
else
echo $line
fi
done

Rgrds,
Rita

Re: Multiple user password change

Jun Zhang_4 — Thu, 02 Oct 2003 11:10:26 GMT

I use perl module Authen-PAM. Creating a thousand users and change the passwords is just a matter of a few minutes. The following url is an introduction to it,
http://www.cs.kuleuven.ac.be/~pelov/pam/Authen/PAM/FAQ.html

Jun

Re: Multiple user password change

Jakes Louw — Wed, 14 Jan 2004 07:19:47 GMT

Just a final point on this:

after looking at expect, and struggling with finding the right version of TCL/TK, we finally just opted for forcing a disable/re-entry of the specified users' password using "passwd -f".

Thanks to whomever suggested this as an alternative.