Need clarification for some output fo "passwd" command.

[senthil_kumar_1]

Hi

I am using HP-UX 10.20, 11.00, and 11.11.


My outputs:

A)

A-1) root@lgapps:/root > passwd -s tanney
tanney PS 05/28/09 14 28

A-2) root@lgapps:/root > passwd -s ze4egi
ze4egi PS

Questions:

why there is difference between the output of A-1 and A-2.

A-1 is showing something like "05/28/09 14 28 ", pls explain about this.

Why A-2 is not displaying anything like A-1.


B)

B-1)root@lgapps:/root > date
Mon Jun 22 08:39:01 CDT 2009

B-2)root@lgapps:/root> passwd -l rtanney

B-3)root@lgapps:/root > passwd -s rtanney
rtanney LK 06/18/09 14 28

Questions:

Actually i locked the account "rtanney" on "Mon Jun 22 08:39:01 CDT 2009". but in B-3 it is showing like "06/18/09".

pls explain

Questions:

[OldSchool]

had you checked the man page, you would have found the following:

"-s name
Display some password attributes associated with the specified name. Superuser privilege and non-trusted mode is required if the files repository is specified. For nisplus, there are no restrictions.

The format of the display will be:

name status mm/dd/yy min max warn

or, if password aging information is not present

name status

where status PS=passworded; LK=locked; and NP=no password."

===========================================================

RE: A-1 and A-2:

ex. A-1 has been set up with password aging, while ex A-2 doesn't have the same. I believe the 5/28/09 date in A-1 is the date the password was last set or changed, while the "14" refers to the minimum #days that must elapse before the password can be changed, and the "28" refers to the maximum #days between changes.


RE: B-3
as above, the "date" refers to the date the password was last changed, not the date the account was locked. You might run "last rtanney" to verify the account was accessed on that date.

Depending (I believe) on OS level and patching, the password aging features may or may not be enabled, or at least not by using /etc/security file (10.20 / 11.0 might be an issue)

[Sunny123_1]

Hi

With reference to man page

-s name = Display some password attributes associated with the
specified name.Superuser privilege and non-trusted mode is required if the files repository is specified.For nisplus, there are no restrictions.


And in B-3 it shows LK means it is lock.

Regards
Sunny

[Pete Randall]

You do have man pages on your systems, don't you? You might want to try reading them.


Pete

[OldSchool]

For your future reference, even if you don't have the man-pages installed, they are available here for 11iv1, v2 and v3:

http://docs.hp.com/en/hpuxman_pages.html


for 10.x and 11.0, see:

http://docs.hp.com/en/archive.html#HP-UX%20Reference%20%28Manpages%29

[senthil_kumar_1]

Hi All,

How to set the aging policies for the users already created and new users.

[OldSchool]

"How to set the aging policies for the users already created and new users."


For users already created, consult the previously noted "man" page(s) for "passwd".

To have the system default those values for new users, you might consult the docs referenced your other thread about this same subject in the following thread:

http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1245802763210+28353475&threadId=1328224

in particular, see the links provided by S.E.P. in the above,

you really need to start:

1) reading responses
2) reading the "man" pages
3) if necessary, start taking notes

[Md. Farhan A Azam]

Hi Senthil,

How to set the aging policies for the users already created and new users.
>> In HP-UX 11.11 folow the below steps to configure aging.

sam -> Auditing & Security -> System Securities Policies (It will ask you to convert the system in trusted mode if not in trusted mode)-> Yes -> It will show you (Successfully converted to trusted mode. Press Ok to continue) ->Ok ->Password Aging Policies -> Here Enable the Policy and configure as per your requirement.

OR

You may configure in /etc/default/security file also.


#vi /etc/default/security


PASSWORD_MAXDAYS=
PASSWORD_MINDAYS=
PASSWORD_WARNDAYS=



Hope it will help you.


thnx...farhan

[Ganesan R]

Hi,

You can set account and password policies using /etc/default/security file.

read this.. or man security
http://docs.hp.com/en/B3921-60631/security.4.html

Another way, convert the system to trusted one. You can set many policies in trusted system.

[Steven E. Protter]

Shalom,

On a simple, most basic level for 11.11 and 11.23 password policy can be set for the system with sam. I'm sure sam's replacement will do the same thing in 11.31.

What that does is set policy in /etc/default/security . Using sam to learn how these settings work is a reasonable path to take.

If you want better output on your original question, try passwd -sa

That provides a slightly more detailed display. The variations you see are based on when the passwd command was written. It is reasonable to expect improvements with newer versions of HP-UX.

SEP