topic Re: Password Expiry Notification in Operating System - OpenVMS

Password Expiry Notification

Trace Trembath — Wed, 19 Apr 2006 16:06:28 GMT

I thought password expiry notification came 1 week prior to the end of a passwords lifetime. Is that correct? So if the password lifetime was 60 days, the expiry notification should start coming at 53 days?

Thank you.

Regards,
Trace Trembath

Re: Password Expiry Notification

Arch_Muthiah — Wed, 19 Apr 2006 17:19:48 GMT

Trace,

Yes it is 1 week. But I am not sure any system parameter (sysgen) or any other parameter is available to change this interval.

Archunan

Re: Password Expiry Notification

John Gillings — Wed, 19 Apr 2006 18:59:56 GMT

Trace,

No, it's not 1 week, it's 5 days:

"Guide to OpenVMS System Security V7.3
3.7.1 Changing an Expired Password

As you approach the expiration time of your password, you receive an advance warning message. The message first appears 5 days before the expiration date and at each subsequent login. The message appears immediately below the new mail message and sounds the bell character on your terminal to attract your attention."

There is no adjustment (though if someone was really enthusiastic and had access to sources, I'm sure they could come up with a patch). I'm not certain if it's an exact "expiration date/time - 120 hours" or any login in the 5th day prior to the day of expiration.

Also note, if you don't login you won't see the message - many of my terminal sessions last MUCH longer than my password lifetime, so I rarely see warnings.

Re: Password Expiry Notification

Arch_Muthiah — Wed, 19 Apr 2006 19:40:48 GMT

Yes Trace, it is 5 days only. But I remember it was 7 days in the old versions. John, have any idea about this notification limit in the older VMS versions.

Archunan

Re: Password Expiry Notification

Stanley F Quayle — Wed, 19 Apr 2006 23:19:28 GMT

Instead of adding a SYSGEN parameter, a "cleaner" approach would be to use the $GETUAI system service. You could add the UAI$_PWD_DATE and UAI$_PWD_LIFETIME values, subtract off whatever number of days you'd like, and "do" something (message? email?).

It would be easy to run this program in the SYLOGIN (interactive users only, please).

Re: Password Expiry Notification

John Gillings — Thu, 20 Apr 2006 02:49:43 GMT

Archunan,

>But I remember it was 7 days in the old
>versions. John, have any idea about this
>notification limit in the older VMS
>versions.

Sorry, as far as I can remember it's always been 5 days.

Re: Password Expiry Notification

David B Sneddon — Thu, 20 Apr 2006 03:01:13 GMT

I believe the logical LGI$EXPIRATION_WARNING_DAYS
(defined in the system table) can be used to
override this.

Dave

Re: Password Expiry Notification

Robert Atkinson — Thu, 20 Apr 2006 03:13:56 GMT

That's a heck of a find Dave - where did you get it from?

Rob.

Re: Password Expiry Notification

Volker Halle — Thu, 20 Apr 2006 03:42:10 GMT

A TIMA article (from http://askq.compaq.com/) says that the Password Expiration Notification Time cannot be changed...

http://h18000.www1.hp.com/support/asktima/operating_systems/00969029-CABDE5A0-1C0186.html

But SEARCH SYS$SYSTEM:LOGINOUT.EXE may indicate otherwise ;-)

Dave, did you try it ? Does it work ? If not documented, it's not supported, but that doesn't mean it doesn't work.

Volker.

Re: Password Expiry Notification

Karl Rohwedder — Thu, 20 Apr 2006 03:46:47 GMT

Worth a try...

$ pi strings loginout.exe | ssi LGI$
LGI$LOGINOUT_CALLOUTS0
LGI$LOGINOUT_CALLOUTS
LGI$LOGINOUT_CALLOUTS
LGI$EXPIRATION_WARNING_DAYS
LGI$PASSWORD_NOCHANGE_DAYS

regards Kalle

Re: Password Expiry Notification

David B Sneddon — Thu, 20 Apr 2006 04:16:25 GMT

I found it in the source listings. The history
indicates it was done in about 2001.

I have not tried it...

Dave

Re: Password Expiry Notification

Wim Van den Wyngaert — Thu, 20 Apr 2006 05:46:37 GMT

Note that the warning is not given when no password is verified. E.g. rlogin or ssh.

Also note that rlogin allows login even when the password is expired. And ssh too but that could be configurable.

Wim

Re: Password Expiry Notification

Trace Trembath — Thu, 20 Apr 2006 12:40:45 GMT

Thank you to all who replied to my question. I believe I have what I need now. Thank you very much. Have a great day everyone!

Regards,
Trace Trembath