Disable user-id

[Tom Gore]

Is there a way for the system to disable a user-id after "X" bad attempts? Also, is there any kind of audit report that can be produced that will show me the invalid logon attempts? Our auditors are at it again and are asking for this information.

Thanks

[Patrick Wallek]

You can disable an id after some number of invalid login attempts if your system is in trusted mode. If it is not trusted, you are out of luck.

As for bad logon attempts, have a look at the 'lastb' command. 'man lastb' for more information.

[Marco Santerre]

You can have the list of bad logon attemps using lastb which is taken from the file /var/adm/btmp

If you turn on Trusted Mode on your systems, you can audit users and also specify several password policies, like password aging and number of password attempts.

You can turn on Trusted Mode by using tsconvert or in SAM.

[Ross Zubritski]

You should be able to manipulate login attempts using the Auditing and Security functionality in SAM.

Regards

RZ

[Sridhar Bhaskarla]

Tom,

Time for you to convert your system to trusted. Apart from the major advantage of hiding the encrypted passwords, it will allow you to configure a variety of options to secure the system. Look at docs.hp.com to get more information on Trusted systems.

'lastb -R' can provide you a detailed report on unsuccessful attempts.

-Sri

[Tom Gore]

Thanks to all. Now all I have to do is find out if they want to switch to a "trusted system". One more questions came to mind. Is there a way to log a user off after "x" minutes of inactivity?

[James R. Ferguson · Accepted solution]

Hi Tom:

If you set the TMOUT environmental variable to a non-zero value (the units are in seconds), then the (Posix) shell will terminate TMOUT seconds after issuing the PS1 prompt. Any entry will otherwise reset the countdown. Thus, to set a 10-minute inactive timeout, do:

# export TMOUT=600

Regards!

...JRF...

[Steven E. Protter]

TMOUT=1900

Is what I set my system is set for.

What this does: It logs out users who are stuck on dollar prompts and not running apps.

What it does not do: If a user has a vi session or an application session open via telnet, it doesn't work.


In that case the application needs a timeout which will dump the user to a dollar prompt or back into the startup script, depending on how the user got in.

SEP

[Tom Gore]

What constitutes an "app". My specific concern are the ignite backups our operators run. If I set TMOUT=1200 and the backup runs longer than 20 minutes do they get logged out? Is the ignite backup still running even though they were logged out?

[Chris Vail]

You can ensure that your ignite tape backup is not terminated by the TMOUT variable with the 'nohup' command. Also send it to the background with the ampersand (&). So "nohup command &" will cause a process to run to completion even when the shell that is its parent terminates.

Chris

[Bill Hassell]

TMOUT is a shell variable and does NOTHING unless the shell is running. When you run the backup program, the shell is suspended (not running) and the timer does not run. When the shell prompt returns after the backup, the timer starts over and the shell will logout after TMOUT seconds.

As far as audting requirements, converting to a Trusted System is the best way to satisfy the auditing requirements as it provides the controls needed to disable accounts and enforce good password rules.