Account Security - password expiration report in HP-UX

[Russ Park]

In Tru64 I've developed a script and C program to report on when an account's password is about to expire (sample output below). What methods are recommended for doing this in HP-UX? The Tru64 method I am using is very specific to the OS... I'm doubtful it would compile successfully. Any ideas?

-Russ Park

Here's the output:

thomp*** Expires in 64 Days on 11/19/2003 08:29 Period: 90
dadkh*** Expires in 69 Days on 11/24/2003 07:24 Period: 90
engla*** Expires in 72 Days on 11/27/2003 11:07 Period: 90
admir*** EXPIRED ON: 11/04/2002 09:32
hrisd*** EXPIRED ON: 05/13/2003 11:23
huffm*** EXPIRED ON: 03/13/2003 13:34

[Steven E. Protter]

If the program had knowledge of a consistent policy, you might start with this data.

passwd -sa

It gives you the date of the last password change.

This is a start.

SEP

[Zigor Buruaga]

Hi,

Maybe "logins" command could be useful.

" ...
-a Displays two account expiration fields. The fields show how long the account can be unused (in days) before it becomes inactive
and the date the account will expire. ..."

From "man logins".
Hope this helps.
Kind regards,
Zigor

[Rajeev Shukla]

Thats not difficult in HPUX, you can write a program like i have written in C using the pr_passwd structure and use this logic..

(todays time+((password expiry time) - (todays time - last successfully changed password)))

Let me know if you like to have a copy of that program of try by yourself.

Cheers
Rajeev

[Con O'Kelly · Accepted solution]

Hi Russ

If you are using a trusted system, then you may be able to make use of the following command:
# /usr/lbin/getprpw

Fields that may be relevant include:
exptm=90
spwchg=Tue Sep 16 14:38:21 2003
expwarn=7

This shows the passwords must be changed every 90days(exptm) & the last successful Password Change was Sep 16 2003.
The "expwarn" field shows the user will be warned 7 days prior to their password expiring.

The /usr/lbin/modprpw command can be used to modify many of these parameters.

Cheers
Con

[Pepe Jimenez Muñoz]

Hi Russ,

we use this script. It write in a file the username and number of days for password expiration.

Hope this help.

# Este script genera un listado en /etc/umios
# que contiene cada usuario y el tiempo que le queda
# para expirar la clave.

> /etc/umios
chmod 644 /etc/umios

ahora=`/usr/contrib/bin/perl -e 'printf "%d\n",time()'`

for i in `cat /etc/passwd | cut -d":" -f1`
do

letra=`echo $i|cut -c1`
#echo $i $letra
ultimocambio=`cat /tcb/files/auth/$letra/$i | awk -F "u_succhg#" ' {print $2}' | cut -d":" -f1
| grep -v ^$`
# echo $ultimocambio
let "dias=180 - (( $ahora - $ultimocambio ) / 86400) "
#echo $dias

echo $i"|"$dias >> /etc/umios

done

[Darryl Lauderdale]

Rajeev;

Seen your post. Could you allow me to have a copy of your progrsm. Passwd expiration.

Thanks
Darryl

[Klaas D. Eenkhoorn]

Russel,

I've recently written a script to calculate te date the password wil expire on a non trusted system.
I use a script called calljd.sh which calculates the julian day of a date supplied to the script. (it can be found somewhere in this forum)

To find out password dates use passwd -a -s, it gives you the date the password is changed and also it gives you the time, in day's, it is valid.

If you have this you can calculate the current day in julian time and calculate the day the password wil expire.

This results in:

'time still valid' = 'expire date' - 'current date'

Kl@@s

[Russ Park]

Thanks for all of the good posts, sorry I took so long in assigning points. although logins command post was good, I really like the getprpw command post and I've also spent time converting the program from the C code on my Tru64 box to run on HPUX. I'll clean it up and post here, so keep your eyes on this post if you're interested. I might try several of the other suggestions and will update as I can.

Thanks again for all your input...

OH - to the person who's code posted in spanish, I'd love to see the English version if possible!

-Russ

[Pepe Jimenez Muñoz]

Hi Russ,

we use this script. It write in a file the username and number of days for password expiration.

Hope this help.

# This script create a file named /etc/umios.
# The content of this file is the user login name and the
# number of days to password expiration

> /etc/umios
chmod 644 /etc/umios

# "ahora" is "now". This variable get the actual time
ahora=`/usr/contrib/bin/perl -e 'printf "%d\n",time()'`

# We have Trusted System activated, so we need to see
# user data in this directories estructres
# /tcb/files/auth/$first_leter_username/$username

# For all users, the $i get the user name
for i in `cat /etc/passwd | cut -d":" -f1`
do

# "letra" is the first leter of user name
letra=`echo $i|cut -c1`

# "ultimocambio" is lastchange. This variable get the time of last password change

ultimocambio=`cat /tcb/files/auth/$letra/$i | awk -F "u_succhg#" ' {print $2}' | cut -d":" -f1
| grep -v ^$`

# We create all users with 180 days of password expiration time, so
# we rest 180 days minus today mnus last change of password, and
# we get the number of days to next password change

let "dias=180 - (( $ahora - $ultimocambio ) / 86400) "

echo $i"|"$dias >> /etc/umios

done

========
I hope that all is clear "ahora" (sorry, now).