password aging policies in HP-UX

[senthil_kumar_1]

Hi

I want to view the password aging policies of the user such as minimum days, maximum days, warning days, date of last password change and password expire date.

[Ganesan R]

Hi Senthilkumar,

Use this command.

#/usr/lbin/getprpw

[Steven E. Protter]

Shalom,

See /etc/default/security

There is a man page and current settings can be viewed.

http://www.docs.hp.com/en/B2355-60103/security.4.html

http://docs.hp.com/en/B2355-60127/security.4.html

SEP

[Ganesan R]

# /usr/lbin/getprpw test
uid=101, bootpw=NO, audid=13, audflg=1, mintm=2, maxpwln=-1, exptm=30, lftm=40,
spwchg=Thu Nov 21 18:07:34 2002, upwchg=-1, acctexp=-1, llog=-1, expwarn=2, usrp
ick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DF
T, timeod=-1, slogint=Thu Nov 21 16:08:10 2002, ulogint=Thu Nov 21 16:07:13 2002
, sloginy=-1, culogin=-1, uloginy=-1, umaxlntr=-1, alock=NO, lockout=0000100


Password Format Policies:

maxpwln ==> Maximum Password Length
nullpw ==> Allow Null Passwords
rstrpw ==> Use Restriction Rules
usrpick ==> User Specifies
syschpw ==> System Generates Character
sysltpw ==> System Generates Letters only
syspnpw ==> System Generates Pronounceable

Password Aging Policies

exptm ==> Password Expiration Time (days)
expwarn ==> Password Expiration Warning Time (days)
lftm ==> Password Life Time (days)
mintm ==> Time Between Password Changes (days)

NOTE: If password aging is disabled, all above parameters are set
to 0.

General User Account Policies

bootpw ==> Require Login Upon Boot To Single-User State
llog ==> Maximum Inactive Time (days)
umaxlntr ==> Unsuccessful login Tries Allowed

NOTE: If Lock Inactive Accounts is disabled, llog is set to 0.

Terminal Security Policies

dlylntr ==> Delay Between Login Tries (sec)
lntmout ==> Login Timeout Value (sec)

[Sajjad Sahir]

Dear Senthil

configuration file is /etc/defualt/security
u can do passwd length passwd aging also a number of thing in this file see the above posting also


thanks and regards

Sajjad Sahir

[senthil_kumar_1]

I get following output when i tried to execute this command.

root@lgapps:/root > /usr/lbin/getprpw test
System is not trusted.


Pls help me.

[Sajjad Sahir]

Dear Senthil

this is available in trusted system
modprpw, getprpw etc..

u system is not trusted.

u can do passwd aging a lot of things in /etc/default/security file see more parameters from there

thanks and regards

Sajjad Sahir

[senthil_kumar_1]

There is no file "/etc/default/security" in my system.

[Ganesan R]

Hi Senthilkumar,

If your system is not converted as trusted, then you cannot use modprpw,getprpw commands.

But still you can set password policies on /etc/default/security file.

see man security

Many things you can do with security.

If you want to know existing password status use the below command

#passwd -sa -> for all users
#passwd -s -> for individual user

[Johnson Punniyalingam]

Hi Senthil Kumar,

On non-trusted systems, general password policy is set by the week, not the day. That is why you had to run a special command, shown above to expire a user the next day.

The passwd -s output is still meaningful. After 7 days if not used, both accounts will be locked.

You have considerable flexibility in setting policy on a non-trusted sysetm.

/etc/default/security configuration will let you set general policy to meet your organizations guidelines.


Thanks,
Johnson