topic Re: Auto Lock in Operating System - Tru64 Unix

Auto Lock

Chris_769 — Wed, 23 Mar 2005 06:42:17 GMT

Hi,

I was wondering if someone knew how to set a user to have his account be automatically be locked out? A client would like that once a account is unlocked, the server (Tru64, 5.1B) would automatically be locked again by a certain time.
Thanks in advance for your response.

Cheers,
Chris

Re: Auto Lock

Radouan Bouzite — Wed, 23 Mar 2005 10:01:12 GMT

use u_unlock field , see man prpasswd

Re: Auto Lock

Johan Brusche — Wed, 23 Mar 2005 10:38:07 GMT

Off-course that is only working after you configure C2-security.....ie secsetup

___ Johan.

Re: Auto Lock

Chris_769 — Wed, 23 Mar 2005 11:37:34 GMT

Hi Johan,

Thanks for the response, but I could not see what I was looking for there.

What I am trying to do is have a user account be unlocked at a certain time and be locked again at certain time in a day.

This way the administrator does not have to manually go in to the account manager and unlock the account and then again lock it before he leaves, for instance.

Did I miss it in the man page or it is another cmd I need? A script or crontab entry?

Cheers,
Chris

Re: Auto Lock

Victor Semaska_3 — Wed, 23 Mar 2005 12:32:59 GMT

As Johan mentioned, you need to have Enhanced Security enabled. You can check/enable it with:

/usr/sbin/sysman secconfig

If you have to enable it I believe a reboot will be required.

Then add two entries in root's crontab.

To unlock the account:
/usr/sbin/usermod -x administrative_lock_applied=0

To lock the account:
/usr/sbin/usermod -x administrative_lock_applied=1

That should do it.

Vic

Re: Auto Lock

Ann Majeske — Wed, 23 Mar 2005 16:48:56 GMT

If you have Enhanced Security (C2) enabled, you could try playing with the u_tod field directly (see "man prpasswd" and "man edauth") or you could set it with the usermod command (see "man usermod" and look for the text under -x "logon_hours"). This field "sets the days of the week and hours of the day during which the account holder can log in to the account", according to the usermod man page.

Ann

Re: Auto Lock

Chris_769 — Tue, 29 Mar 2005 02:20:58 GMT

Hi Ann,

That's great, thanks for the tip, will try it and hope it works. Thanks.

Cheers,
Chris

Re: Auto Lock

Alexey Borchev — Tue, 29 Mar 2005 08:48:23 GMT

Cris,
1) You need C2 enabled indeed.
2) After that, You'll be able to setup working hours via Account manager.
It's little bit simpler&safier, than fiddling with config files directly.

Re: Auto Lock

Chris_769 — Fri, 01 Apr 2005 05:55:52 GMT

Hi All,

1st, thanks for your replys.
2nd, results: usermod did nto work. now the account is locked out all the time, cant get in, only get this:
Wrong time period to log into this account.

The crontab entry worked for locking the account, but not for unlocking it. Have Enhanced Security (C2), but dont have Accoutn manager, need to do this through cmds. Crontab had set for lock and then unlock 1:30 later same day specifics.

usermod had entered only one day for it to be locked, but now locked all days.

Any ideas?

Cheers,
Chris

Re: Auto Lock

Victor Semaska_3 — Fri, 01 Apr 2005 09:19:49 GMT

Chris,

I don't understand. I tried it on my test box and it worked fine. Could you list the crontab entries.

Also, that message 'Wrong time period to log into this account.' bothers me. I never seen that one before. Sounds like the 'Time of Day' field in the 'Login Restriction' security window was somehow set.

Why can't you run dxaccounts on the console?

Vic

Re: Auto Lock

Ann Majeske — Mon, 04 Apr 2005 12:05:11 GMT

Chris,

Can you post the results of "edauth -g " on the account that you did the usermod command?

Ann

Re: Auto Lock

Chris_769 — Mon, 04 Apr 2005 12:16:33 GMT

Hi,

I dont understand why the crontab did not work either:

It locked fine, but would not unlock. I have removed the two lines, but I know that they were correct.

The usermod worked. It was that I had entered Wk instead of listing each day.
Does anyone know how to remove it now if I want to? It is the u_tod= that needs to be removed in the db.
Any ideas how that fine can be edited?

Many cheers,
Chris

Re: Auto Lock

Victor Semaska_3 — Mon, 04 Apr 2005 12:36:01 GMT

Chris,

Try this:

usermod -x logon_hours=""

Vic

Re: Auto Lock

Ann Majeske — Tue, 05 Apr 2005 08:55:11 GMT

usermod can be used to modify the account.

You can also use the edauth command to modify the fields directly. See "man edauth" for information on the edauth command. See "man prpasswd" for information on the fields.

Ann

Re: Auto Lock

Ralf Puchner — Wed, 06 Apr 2005 08:07:57 GMT

Howto enable automatic logout of idle telnet sessions

Set environmental variables:

csh and tcsh
set autologout=60

where 60 represents the number of minutes if inactivity.

ksh and bash
TMOUT=3600 ; export TMOUT

where 3600 represents the number of seconds of inactivity.

C2 is not necessary here!