cancel
Showing results for 
Search instead for 
Did you mean: 

Auto Lock

Chris_769
Occasional Visitor

Auto Lock

Hi,

I was wondering if someone knew how to set a user to have his account be automatically be locked out? A client would like that once a account is unlocked, the server (Tru64, 5.1B) would automatically be locked again by a certain time.
Thanks in advance for your response.

Cheers,
Chris
14 REPLIES

Re: Auto Lock

use u_unlock field , see man prpasswd
Johan Brusche
Honored Contributor

Re: Auto Lock


Off-course that is only working after you configure C2-security.....ie secsetup

___ Johan.

_JB_
Chris_769
Occasional Visitor

Re: Auto Lock

Hi Johan,

Thanks for the response, but I could not see what I was looking for there.

What I am trying to do is have a user account be unlocked at a certain time and be locked again at certain time in a day.

This way the administrator does not have to manually go in to the account manager and unlock the account and then again lock it before he leaves, for instance.

Did I miss it in the man page or it is another cmd I need? A script or crontab entry?

Cheers,
Chris
Victor Semaska_3
Esteemed Contributor

Re: Auto Lock

As Johan mentioned, you need to have Enhanced Security enabled. You can check/enable it with:

/usr/sbin/sysman secconfig

If you have to enable it I believe a reboot will be required.

Then add two entries in root's crontab.

To unlock the account:
/usr/sbin/usermod -x administrative_lock_applied=0

To lock the account:
/usr/sbin/usermod -x administrative_lock_applied=1

That should do it.

Vic
There are 10 kinds of people, one that understands binary and one that doesn't.
Ann Majeske
Honored Contributor

Re: Auto Lock

If you have Enhanced Security (C2) enabled, you could try playing with the u_tod field directly (see "man prpasswd" and "man edauth") or you could set it with the usermod command (see "man usermod" and look for the text under -x "logon_hours"). This field "sets the days of the week and hours of the day during which the account holder can log in to the account", according to the usermod man page.

Ann
Chris_769
Occasional Visitor

Re: Auto Lock

Hi Ann,

That's great, thanks for the tip, will try it and hope it works. Thanks.

Cheers,
Chris
Alexey Borchev
Regular Advisor

Re: Auto Lock

Cris,
1) You need C2 enabled indeed.
2) After that, You'll be able to setup working hours via Account manager.
It's little bit simpler&safier, than fiddling with config files directly.
The fire follows shedule...
Chris_769
Occasional Visitor

Re: Auto Lock

Hi All,

1st, thanks for your replys.
2nd, results: usermod did nto work. now the account is locked out all the time, cant get in, only get this:
Wrong time period to log into this account.

The crontab entry worked for locking the account, but not for unlocking it. Have Enhanced Security (C2), but dont have Accoutn manager, need to do this through cmds. Crontab had set for lock and then unlock 1:30 later same day specifics.

usermod had entered only one day for it to be locked, but now locked all days.

Any ideas?

Cheers,
Chris
Victor Semaska_3
Esteemed Contributor

Re: Auto Lock

Chris,

I don't understand. I tried it on my test box and it worked fine. Could you list the crontab entries.

Also, that message 'Wrong time period to log into this account.' bothers me. I never seen that one before. Sounds like the 'Time of Day' field in the 'Login Restriction' security window was somehow set.

Why can't you run dxaccounts on the console?

Vic
There are 10 kinds of people, one that understands binary and one that doesn't.
Ann Majeske
Honored Contributor

Re: Auto Lock

Chris,

Can you post the results of "edauth -g " on the account that you did the usermod command?

Ann
Chris_769
Occasional Visitor

Re: Auto Lock

Hi,

I dont understand why the crontab did not work either:

It locked fine, but would not unlock. I have removed the two lines, but I know that they were correct.

The usermod worked. It was that I had entered Wk instead of listing each day.
Does anyone know how to remove it now if I want to? It is the u_tod= that needs to be removed in the db.
Any ideas how that fine can be edited?

Many cheers,
Chris
Victor Semaska_3
Esteemed Contributor

Re: Auto Lock

Chris,

Try this:

usermod -x logon_hours=""

Vic
There are 10 kinds of people, one that understands binary and one that doesn't.
Ann Majeske
Honored Contributor

Re: Auto Lock

usermod can be used to modify the account.

You can also use the edauth command to modify the fields directly. See "man edauth" for information on the edauth command. See "man prpasswd" for information on the fields.

Ann
Ralf Puchner
Honored Contributor

Re: Auto Lock

Howto enable automatic logout of idle telnet sessions

Set environmental variables:

csh and tcsh
set autologout=60

where 60 represents the number of minutes if inactivity.

ksh and bash
TMOUT=3600 ; export TMOUT

where 3600 represents the number of seconds of inactivity.

C2 is not necessary here!
Help() { FirstReadManual(urgently); Go_to_it;; }