Need to get password Attributes

[Vidhya B]

Hi all,

Kindly help me how to get the followin following attributes through a command.
I can understand that I can view them in /etc/default/security file. But I need to find them through command.

PASSWORD_HISTORY_DEPTH
ABORT_LOGIN_ON_MISSING_HOMEDIR
MIN_PASSWORD_LENGTH
PASSWORD_MIN_UPPER_CASE_CHARS
PASSWORD_MIN_DIGIT_CHARS
PASSWORD_MIN_SPECIAL_CHARS
PASSWORD_MAXDAYS
PASSWORD_MINDAYS
PASSWORD_WARNDAYS

Thanks in Advance!!!

[Steven Schweda]

> [...] But I need to find them through
> command.

cat /etc/default/security

What, exactly, do you mean? What, exactly,
does "find them through command" mean to you?
What, exactly, would you like to do?

grep PASSWORD_HISTORY_DEPTH /etc/default/security

There it is. Now what?

[Vidhya B]

Hi,

I can understand that I can grep.

I am writing a script to review hardening policies.
If I grep from that file and then compare values, it will make it length.

In order to find the umask, we will use the command umask. In the similar way if there is any specific command(s) which gives me the output for the above attributes.

For eg regarding PASSWORD_HISTORY_DEPTH, If my PASSWORD_HISTORY_DEPTH is 5, then if I am able to get a command which gives me this value directly, I will be able to assign it to a variable and compare with the actual hardening policy.
This will reduce time and length of the script.

Please help.

[Steven Schweda]

> I am writing a script [...]

Should I have known that?

> [...] assign it to a variable [...]

Should I have known that?

> I can understand that I can grep.

That's good, but you seem to need to learn
some shell script basics. For example, ``
or $() can be used to work with the output of
a command (or pipeline).

phd=` grep PASSWORD_HISTORY_DEPTH \
/etc/default/security | \
sed -e 's/.*=//' `

echo $phd

Interactively:

dyi # phd=` grep PASSWORD_HISTORY_DEPTH \
> /etc/default/security | \
> sed -e 's/.*=//' `

dyi # echo $phd
4

[Vidhya B]

Hi,

Actually I have another issue even.

There are few entries in that file which is already commented.

So If two PASSWORD_HISTORY_DEPTH(one commented) exist in the file, then that will cause problem again.

[Duncan Edmonstone]

So further judicious use of the sed command should get rid of any comment lines (and blank lines):

SO you had:

phd=` grep PASSWORD_HISTORY_DEPTH \
/etc/default/security | \
sed -e 's/.*=//' `

echo $phd

That could become:

phd=` sed -e 's/#.*//g' -e '/^$/d' \
/etc/default/security | \
grep PASSWORD_HISTORY_DEPTH | \
sed -e 's/.*=//' `

echo $phd

You could probably make this more efficient by combining those sed calls into one, but I've left them seperate so you can get a feel for what is happening here...

HTH

Duncan

[Steven Schweda]

> [...] (and blank lines):

How easy is it to find a blank line which
also has the desired keyword on it?

[Duncan Edmonstone]

>> How easy is it to find a blank line which
>> also has the desired keyword on it?

Ha! I take your point - I guess I was using it out of context - I'm in the habit of always putting those two sed constructs together as I'm ass-u-me(ing) the output will be read by a person rather than another command in a pipeline...

for example... I don't like the output of:

swlist -l fileset -a state

I much prefer to look at :

swlist -l fileset -a state | sed -e 's/#.*//g' -e '/^$/d'

So I left it in in this case cos I thought the original poster might be curious enough to deconstruct the pipeline, and it would show him a cleaner output...

HTH

Duncan

[Steven Schweda]

> [...] I thought the original poster might
> be curious enough [...]

I wish, but there's not much evidence for it.

[Dan Bolton]

Or you could reject the comment lines by using:

phd=` grep ^PASSWORD_HISTORY_DEPTH /etc/default/security ...

thus anchoring the expression to the beginning of the line. ("man 5 regexp" if you need further info).

-db