HP-UX account locked out policy to be configured.

[Narendra Uttekar]

Hi,
I am having HP-UX 11i V1 running on PA-RISC servers. I have configured this default security on the system as below,
Server1:[/]# cat /etc/default/security
PASSWORD_MIN_UPPER_CASE_CHARS=1
PASSWORD_MIN_LOWER_CASE_CHARS=1
PASSWORD_MIN_DIGIT_CHARS=1
MIN_PASSWORD_LENGTH=8
PASSWORD_HISTORY_DEPTH=5
PASSWORD_MAXDAYS=90
PASSWORD_MINDAYS=1
PASSWORD_WARNDAYS=7

Server is not configured as trusted system.

Please can you let me know where do i have to do settings so that any user who try to login with is password and if he tries more than 3 times with wrong password account should get locked...

Thanks,
Narendra

[Ismail Azad]

Hey narendra,

These are system wide defaults in /etc/default/security which is at a global level for all users on that server.

What you are acheiving or trying to acheive is one of the reasons to go "trusted". I suggest you convert your system to a trusted system as this is one of the features of a trusted system compared to the normal legacy services or what is nicely termed as the passwd mode.

Regards
Ismail Azad

[Dennis Handly]

>Server is not configured as trusted system.

You may not be able to do all of these without being trusted or having shadow passwords.

[Narendra Uttekar]

Hi Dennis,
Please can you let me know where to do exactly the settings for Account locked out policy. As I am having shadow password software installed.

Server1:[/]# swlist |grep -i shadow
ShadowPassword B.11.11.03 HP-UX 11.11 Shadow Password Bundle

Thanks,
Narendra

[Steven E. Protter]

Shalom,

If you don't want to go trusted you must go with Shadow password depot (listed in an earlier post).

Your only other option is a scripted option that regularly scans the btmp file and locks out the user after a certain number of bad logins.

Outline:

cat /etc/passwd | awk -F: '{print $}'| while read -r un
do
blogs=$(strings /var/adm/btmp | grep $un | wc -l)
if [ $blogs -ge 3 ]
then

passwd -l $un
fi
done


You might want to enhance this script to perhaps send an email to someone to let them know the user is locked. I can help with that if you wish.

SEP