check password strength

[Simon Jespersen]

Hi! Ive have done some modifiction on user security and have done a scan with enterprise security manager (symantec software) and i get reports saying.


User without system password strength The passwords for the accounts listed have not been checked by the system's password strength program. All passwords should be checked both by the system's password strength program and by Symantec ESM's Password Strength module.

what do esm mean by systems password strength program ?

[RAC_1]

I do not think hp has something like that. HP system can have trusted computer base and extended security system(I think only for latest OS versions)

Symantech ESM should have required details in documents.

[Chan 007]

Hi Simon,

I guess some of your user's password fails in one of the following

Minimum Length
History Length
Require non-alphabetic character
Maximum Password Age
Number of Invalid Logins before lock out
Reset Locout counter-reset after
Reset local out after duration

These are the paramenter that Password Strength is calculated. The log file is password.m, that will have the details of the errors that you getting check that to solve the problem

Hope this helps
Chan

[Simon Jespersen]

Hi thank you for the anwsers im chekking out your replies, how can i se if a system is running in a trusted mode, our servers are suppose do run tcb. but i want to be shure.

[Chan 007]

Simon,

Even though you have a trusted system , you can have this ems s/w configured on you system.

To check you are in a trusted system check the following,

you will have all users in /tcb/files/auth

check r directory for root users information, if you have a user called simon, his information will be in s (lowercase).

emc process will run as agent. So check the logs as said in the prev thread.

Try downloading EMS documents from Symentec website.

Chan

[RAC_1]

You can run following commands to do some certain basic checking
grpck
authck
pwck
/usr/sbin/logins -d
/usr/sbin/logins -p

[Bill Hassell]

The Symantec program may or may not be compatible with HP-UX Trusted systems. If you do not have a directory /tcb, then you have don't have any password strength features. But if you have a Trusted system (or you convert to Trusted), you should have created and edited the file /etc/default/security and add the features listed in the man page for security. These features should be set to correspond to your corporate security standards.

The Symantec generic term "system's password strength program" is referring to the passwd program in HP-UX which uses either standard password policies (not Trusted) or looks at the /tcb default policies as well as the security file. SAM can display the password policies currently set on your system.