Excluding user account from /etc/default/security settings

[James R Stewart]

Hello,
My company is implementing tighter security controls on our HP_UX 11.11 systems.

Existing service accounts exist (tied to the application on the box) that are used by many people all over the world.

Q: Is it possible for instance to exclude a user account "oracle" from the password policy settings contained in /etc/default/security/:
MIN_PASSWORD_LENGTH=8
PASSWORD_WARNDAYS=10
PASSWORD_MINDAYS=1
PASSWORD_MAXDAYS=56
PASSWORD_HISTORY_DEPTH=12

From my limited experience, the answer is no, but I wanted to ask those more knowledgeable.

Thanks,
James

[Patrick Wallek · Accepted solution]

No, that is not possible as far as I know.

The setting in /etc/default/security are global.

[atul2701]

Hi James,

if you are using trusted system than you can exclude oracle accont. For that you need to change the seetings for oracle user using modprpw command.

[Steven E. Protter]

Shalom James,

The password requirements can probably not be overridden. e.g. the complexity requirements. Though passwd and modprpw command may be able to be used to override the length of time a password is good.

To override complexity requirements you can set the oracle password with the root user. Be forewarned: Many security audits try and crack the password of important users. If you choose something too simple, it will show up on a security audit report.

I recall a company I worked with in India had a system hacked and the oracle password was guessed. The password was set to oracle. They bad!!!

SEP

[James R Stewart]

thank you all, you have answered my question

[James R Stewart]

solution found