changing password on Trusted Mode.

[Chirag Parekh]

Hi,

We have two HP-UX 11.11 servers running in Trusted mode. Both of them have the same security/password aging policies with a minimum password change time of 7 days on both. On one server I am able to change passwords within 2-3 days and am able to set it to something that I had recently used. On the other server it does not allow me to re-use a recently used password. Checked the /tcb/files/auth/system/default as well as the /tcb/files/auth/*/* files for that particular account on both servers and found everything to be identical. Can someone tell me what am I missing in terms of settings on either of the server so as not to allow re-use of recently used password?

Thanks.

[Bharat Katkar]

HI Chirag,
Refer to the doc attached.
That should help.
Regards,

[Chirag Parekh]

Hi Bharat,

I went thru the document and looked at all the settings and couldn't find anything different on both the servers. Herewith I am attaching the /tcb/files/auth/*/* for user oracle from servers banff and mecca. On server banff I am able to re-use a recently used password.

Thanks.

[Bharat Katkar]

Hi
Check this on both server and see if they are same.
#/usr/lbin/getprdef -m lftm

Regards,

[Chirag Parekh]

Checked on both servers and it's 0.

Thanks

[Franky_1]

Hi Chiraq,

you can explicitly set the params on both machines with
/usr/lbin/modprdef
-exptm= or
-mintm=

HTH

Franky

[Cheryl Griffin]

I would check if patching is the same on both machines:
# swlist -l fileset |egrep -e "libc|libpam|libsec|ONC"

[Chirag Parekh]

Hi Cheryl,

Patching is the same on both servers.

Thanks.

[Darren Prior]

Hi,

It sounds to me like you have /etc/default/security configured on one system with PASSWORD_HISTORY_DEPTH=n. This prevents the last n passwords being re-used. See man security for more info on this functionality.

regards,

Darren.

[Chirag Parekh]

Darren,

The Password_History_Depth on both the servers is set to 10.

Thanks.

[Chirag Parekh]

Still looking for a resolution to the problem?

Thanks.

[Chirag Parekh]

Someone had posted a reply on the 29th of July with an attachment about how to re-use an old password on a Trsuted mode. But I cannot see the reply now. Can someone post it again?

Thanks.

[Darren Prior]

Hi,

I believe one of the other moderators may have deleted it; posting Knowledge Base documents is not allowed - they are only accessible if you have a software contract with HP.

regards,

Darren.

PS: I'll see if I can find the ref number for the doc, which is allowed to be posted.

[Darren Prior]

Hi,

I've just checked - the only document I found on this subject is for HP internal use only so it wouldn't even be visible via the Knowledge Base.

regards,

Darren.