Blocking an account after 3 login attempts for 30 mins

[Starkhorn]

Hi all,

I need to setup a HP-UX 11.11v1 trusted system so that I can block a user account after 3 failed login attempts for 30 minutes, i.e. the user can try to login again after 30 mins.

Now in SAM I can change number of "Unsuccessful Login Tries Allowed: " field but this seems to block the account indefinitely until an administrator manually unblocks. I want the system to unblock it automatically after 30 mins or whatever time period I like.

Is this possible and if so how/where can I configure this?

Many thanks in advance.

[Patrick Wallek · Accepted solution]

Nope, this is not really possible with HP-UX. There is no place to set an amount of time for the account to remain locked.

[Rick Garland]

An account with 3 unsuccessful login attempts is worth a look-see to determine if there is an attempt at security breach.

[Don Mallory]

Use LDAP-UX & Kerberos to a directory. Microsoft's Active Directory has a number of account lockout policies that include time based lockouts.

You will also be able to use 128 character passphrases instead of the DES based 8 character limit on HP-UX.

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=J4269AA

There are lots of docs about this. See my other posts for much more info.

[Keith Buck]

You can setup a cron job to unlock the accounts every 30 minutes. This isn't quite what you asked for (because the unlock time will vary from 0 to 30 minutes depending on when it got locked) but it is close to the same policy.