Creating a administrative— function (e.g. change password

[Dan Walker]

I need to create a account where this function can only change passwords nothing else for a help desk

[Tim Nelson]

Once upon a time we ran into the same dilemma.

We addressed it as follows.

We created a script that resticted the password changes with an exclusion list.. i.e. root account, admin accounts, others,

Create a SAM action to execute your script as root.

Create each help disk user a unix account, cuz you know that gang logins are bad.

Give each help desk user access to restricted sam.

Be sure to triple test the security of the script.

[A. Clay Stephenson]

You can do this with a restricted sam session but perhaps the best way to implement this function is via sudo.

[whiteknight]

Dan,

You can install RBAC, HPUX 's sudo equivalent.

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=AccessControl

To assign specific role.

WK