About password policy setting in untrusted system

[ikbea]

Hi all,

In HPUX 10.20 untrusted system, how to set the following for user accounts ?

1. Password Expiry Grace period (I can find the password expiry interval only in 'password aging')

2. Keep password history for times

3. Disable user after times unseccessful
login

4. Kill session for idle mins/secs

Thanks

[Sunil Sharma_1]

I don't think you can do much on this.
specially on HPUX 10.20 in 11i you can set some policies in /etc/default/security file.

Only way is to convert system in trusted mode.

Sunil

[ikbea]

Do all the above features available if I convert from 10.20 non-trusted to 10.20 trusted system ?

[Hoefnix]

Hi,

I think you will have almost all except #4.
But be aware of all other issues when converting to trusted. All apsswords will be expired and truncated to 8 chareacters for example.

HTH,
Peter

[Darren Prior]

Hi,

I have to point out that 10.20 is an obsolete OS. That said, if you want to convert it to a trusted system, it's vital that you ensure it's well patched. There are a number of essential trusted patches, if they are missing it would be dangerous to convert the system. Have a search through the forums if you need to know the patches - I've posted them in a couple of threads previously.

I don't think a 10.20 trusted system will give you password history as I believe it's determined in /etc/default/security.

Option 4 is not part of a trusted setup.

regards,

Darren.

[Floyd Curtis]

Regarding number 4
4. Kill session for idle mins/secs

Do a search for info on the shell variable TMOUT (upper case). There are ways for setting it globally or user specific if you place in there .profile

good luck
fwc

[ikbea]

Thanks for all response and I will consider whether change to trusted system or not.

[ikbea]

Another related question,
Does 10.20 support keeping password history (e.g. keep records of the last 3 passwords)? According to threadid=60172, do I need to apply patch PHCO-13913 ?

Thanks again!

[Isralyn Manalac_1]

no password history on 10.20.

[ikbea]

Which version have password history feature? 10.x or 11.0 or 11i ?

[Darren Prior]

Hi,

The patch you mentioned is probably the first time /etc/default/security was mentioned for 10.20, however it does not cover password history. This feature is available at 11.00 and 11i and above. For 11.00 you will need to have a recent libpam patch.

regards,

Darren.

[Colin Topliss]

BEFORE converting to trusted (C2), please bear in mind that it will possibly break any client/server applications that use authentication. The method for querying the password file changes under C2, and most applications don't cater for this. Also, back under 10.20, there was a problem if your root password was not C2 compliant when the system was converted. When trying to log into root after conversion, it would complain that the password was invalid. Trying to change the password would also fail.

HP did recently release the shadow password capability as a separate entity, but this doesn't work with LDAP or NIS, and I don't remember if there was a version for HP-UX10.20.