how to change the no of characters , numerical letters in trusted mode.

[Mani K]

Hi gurus,

I need a help.
I have converted my system in to trusted mode.
I set the maximum length of password =12.

I also wanted to specify the no of characters and numericals , and special characters manually.
Moreover , can u tell me , what is the default combination available in trusted mode ?


thank u all ..

Mani

[Peter Godron]

Mani,
can you have a look at the
/etc/default/security
file.

There should be things like:
PASSWORD_MIN_UPPER_CASE
etc.

[Mani K]

thanks guru,
I just wanna know , does trusted system refer /etc/default/security ?

-Mani

[Pete Randall]

Yes, a trusted system does respect /etc/default/security. See "man security".


Pete

[Jeff Schussele]

Hi Mani,

In the /etc/default/security file you can have such statements as:

PASSWORD_HISTORY_DEPTH=
PASSWORD_MIN_UPPER_CASE_CHARS=
PASSWORD_MIN_LOWER_CASE_CHARS=
PASSWORD_MIN_DIGIT_CHARS=
PASSWORD_MIN_SPECIAL_CHARS=

That define the values enforced by a trusted system.
These are almost mandatory now for SOX servers or you'll get dinged in a SOX audit.

You should also look at the /tcb/files/auth/system/default file because that's where you set PW values such as lifetime, minimum time between changes, max PW entry tries, PW max length & several more.


Rgds,
Jeff

[Bill Hassell]

A Trusted system uses two files for rules on password creation as mentioned. Now the /etc/default/security does not exist on a new system. I have attached a sample security file with lots of comments. NOTE: the security files has dramatically changed over the last few years and working settings depends on security patches as well as the version of HP-UX. So the best rule is to download the security patch checker, add all the missing security patches and then check the man page for security to see what is enabled. A misspelled parameter name is silently ignored, so you'll have to test your settings.

[bhumireddy]

Hi , thanks for your replies,
see.. my /etc/default/security is like this

******************************************
ABORT_LOGIN_ON_MISSING_HOMEDIR=1
MIN_PASSWORD_LENGTH=8
PASSWORD_HISTORY_DEPTH=3
#PASSWORD_MIN_SPECIAL_CHARS=1
SU_ROOT_GROUP=root
UMASK=027
***************************


in /etc/default/security file i mentioned minimum length is 8 and , in /tcb/files/auth/system/default i mentioned the max length is 40.

But when i change the passwd from 8 characters to >8 , i could not login to the system. i don't know what other steps to be followed up. Pls help..


regards,
Mani

[Peter Godron]

Mani,
did you use SAM to convert your system?
Are you using SAM to maintain/change policies?
If you are not confident in what you are doing, I would recommend always using SAM.
It's easy to make a typing mistake whilst editing files.

For your current problem:
Are you running NIS? Have a look at your /etc/nsswitch.conf file, does it only refer to files, or do you have compat mentioned?

[Bharat Katkar]

See if the doc attached helps.
Regards,

[Bharat Katkar]

See if the doc attached helps.
Regards,

[bhumireddy]

Hi all,

I have converted it using SAM only.
Is there any recommended patch to be applied before convertion.


$ uname -a
HP-UX TTLDRSAS B.11.11 U 9000/800 4204107669 unlimited-user license

regards,
Mani