Password history inquiry in Trusted System

[Juan M Rodriguez]

Hello,

I am trying to figure out from C how to query the password history in a Trusted system in HP-UX. In Tru64, using getprpwent() the espw_field structure has a char *fd_pwdict which is a pointer to the password history dictionary, which you can use to check if the new password doesn't match the history rules. However, in HP-UX using getprpwent() the pr_field structure doesn't seem to have any element to access the password history for the user.

Any ideas are appreciated.

Thanks,

Juan Miguel Rodriguez

[Steve Steel]

Hi

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=62625

May help


Steve Steel

[Juan M Rodriguez]

Hmm..

thanks. I had already looked at that, but it provides no info on how to check the password history.

Juan Miguel

[Steve Steel]

Hi


Is it set up

Password History Feature on Trusted Systems



Password history is a new trusted-system feature of the passwd command, used to discourage users from re-using previously used passwords.
The system administrator enables the system-wide password history feature by creating (or opening, if it already exists) a file called /etc/default/security and appending an entry:

PASSWORD_HISTORY_DEPTH=number
Depending on the value of number (decimal integer from 1 through 10), the system checks the user's new password against that number of previously used passwords and prevents their usage. (For example, if number=5, the system will not allow a user to use any of the last five passwords he or she has previously used.)
Structurally, the password history feature is accomplished by a shared library, called libpam_unix.1, which is dynamically loaded at run time by the command. This structural characteristic is totally transparent to users; the end-user interface of the command is unchanged.

For further information, consult the passwd(1) manpage.

See
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5187-1361/5187-1361_top.html&con=/hpux/onlinedocs/5187-1361/00/01/120-con.html&toc=/hpux/onlinedocs/5187-1361/00/01/120-toc.html&searchterms=passwd%7chistory%7ctrusted&queryid=20041203-074404


steve Steel

[Juan M Rodriguez]

Thanks,

are you suggesting that what I am asking can not be done? That the passwd command is the only one that can do this? Reading it I see that passwd uses PAM, which, in theory, I could use as well. Now, the problem is that our application is a 64bit application, and PAM in HP-UX 11.11 (PA-RISC) is strictly 32bit, so we can't use it from a 64bit app. In HP-UX 11i v2 PAM is 64bit in PA and IPF, but we can't force people to switch to the new OS at the drop of a hat.

So, my question remains: Can you from a C program check the password history for an user programatically in an HP-UX Trusted system?

Thanks,

Juan Miguel

[John Kittel]

I don't know how to do what you are asking, but perhaps this can help you a little bit... the history is stored in /tcb/files/auth/system/pwhist/.