Customizing Security settings-HPUX 11.23

[Jim Poplawski]

Folks,
Our customer is requesting some changes to our security settings. We are running HP-UX 11.23 in trusted mode. I'm not sure I agree with what they want, but first, what is possible in what they asked.
First, they want to change the "invalid login" string that comes up when a user has a wrong password or the account is locked. I haven't seen a file that has the text that displays for those prompts, so I'm assuming that it's not possible. Am I correct ?
Secondly, they want * to print when the user types their password instead of not echo-ing anything. (darn windows bigots)
They also want a max of 3 invalid logins before kicking you out. I see the parameter in SAM to set for that for modems/terminals, (and that is set) but it says that does not apply to network sessions. Do I need to play with the login timeout setting to get it to line up or is there another setting?
Thanks
Jim

[A. Clay Stephenson · Accepted solution]

Without writing custom code, the only one of these that is "doable" is setting the maximum unsuccessful login attempts. This can be set on either a user-by-user basis or on a system-wide basis. If the umaxlntr value is defined for a user it takes precedence over the system-wide value. The value can be changed using modprpw. Man getprpw and modprpw for details.

[Patrick Wallek]

Request 1 - Change "invalid login" -- NOT POSSIBLE as far as I know.

Request 2 - print *'s when entering passwords -- NOT POSSIBLE as far as I know.

Request 3 - max 3 invalid logins before kicking you out -- NOT POSSIBLE as far as I know.

I think the only way to do these things would be to write a custom login program or PAM module.

[Patrick Wallek]

I stand corrected on request 3. That does work (as if I'd expect anything less from Clay!).

[Jim Poplawski]

Sorry, to clarify item 3, it's not necessarily 3 invalid attempts from 1 particular id, it's 3 from that login session. So if I try userid Joe with a bad userid or password and then Mary and then Sam, then the session should close.
thanks for the VERY quick responses.

[Bill Hassell]

> "invalid login" ... am I correct?

Yes. There is no customization mechanism. This message is hard coded in the program.

> want * to print

Again, no mechanism exists to change this. The stty command allows echo or no-echo but no translation.

> 3 invalid logins ...

From the login man page:
"After three unsuccessful login attempts, a HANGUP signal is issued."

On a trusted system, /usr/lbin/modprdef is the UNDOCUMENTED command that accomplishes such changes. SAM calls this command so when you change the login retry count, parameter umaxlntr is used, and for timeout until user can try again, the value is dlylntr. The SAM log shows the actual command so you can guess the meaning of the parameters by changing a number and seeing the resultant command line.

[Torsten.]

BTW - while talking about security AND telnet ...

Using telnet is the security hazard, isn't it?

[Jim Poplawski]

Right now it's a pretty closed network, but we're also moving to ssh, sftp, etc to take that out of the picture as well.
thanks!

[Jim Poplawski]

Got some test time today, and the parameter you can set in SAM to set the number of invalid logins for modems/terminals also works for telnet and ssh sessions as well.
Thanks to all for your assistance on this.

[Jim Poplawski]

Folks,thanks for all the feedback.