Bastille - password aging issue.

[Gino Castoldi_2]

Hi,

HP-UX 11.0 Bastille B.02.00
(ITO 5.39)

We ran Bastille on a L2000 server and because we run HPOV
ITO this caused a problem when
the Bastille tool converted the server into a "trusted system". The problem occurs
when it enables password aging.

Is there a way to turn off
password aging? I disabled it
after Bastille ran but I would like to have it disabled during and after Bastille runs. Does Bastille
have this option? Is there some way I can disable password aging so that Bastille won't enable it?

10 points to any good answer.
Thank you Gino.

[harry d brown jr · Accepted solution]

Gino,

Read this thread, Keith Buck says you can customize the security:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x4f9793e260b0d611abdb0090277a778c,00.html

live free or die
harry

[Keith Buck]

Gino,

From my samlog when I use SAM to disable password aging:

Executing the following command:
/usr/lbin/modprdef -m \
usrpick=YES,rstrpw=NO,nullpw=NO,syspnpw=YES,syschpw=NO,sysltpw=YES,bootpw=NO,mintm=0,lftm=0,exptm=0,expwarn=0,umaxlntr=3,llog=-1,tmaxlntr=10,dlylntr=2,lntmout=0,maxpwln=8

Note that that very long line is all on the same line, no spaces. Also note that this command does more things by setting all parameters explicitly. You should be able to do something shorter like:

/usr/lbin/modprdef -m mintm=0,exptm=0,lftm=0,llog=0,expwarn=0

(Formatting is coming across strangely, sorry...)

Bastille does not currently provide all of the knobs that SAM does in terms of setting specific password policies; it is more automated. We will add this to our futures list and continue to improve the flexibility in this area. Thanks for asking! :)

Also, thanks for the feedback about this specific option in OVO and its interrelationship with trusted mode/password aging. We'll at least add that to the question as a warning.

[Gino Castoldi_2]

Keith,

From what you are saying is
that Bastille currently does not have the option of disabling the "password expiration" function.

I can disable this option after the fact with SAM.

If I disabled password expirations (SAM) before I run the Bastille tool will this stop Bastille from doing so when it is run?

10 points to any good answer.
Thank you Gino.

[Keith Buck]

If I disabled password expirations (SAM) before I run the Bastille tool will this stop Bastille from doing so when it is run?

Yes. Bastille will detect that the system is already trusted and not take any action. We're working on functionality which will detect this case and not even ask the question.

Maybe in the future we'll get more granular options within Bastille for password policies, etc. but for now we'll leave that in the realm of SAM. (SAM has a lot of functionality in this area and it would be a lot of work to duplicate all of it, and I wouldn't know where to stop.)

Hope that helps.

[Gino Castoldi_2]

Hi Keith,

Thank you for your reply.

I followed your advice and I "trusted" the system first using SAM and then I disabled the Password Aging" option.

Afterwards I ran Bastille and
it didn't expire the passwords
so this looks like the way to
get around this problem.

(10 points to any good answer)
Thank you again Gino.