how to get a warning before passwords expire

[Dave Chamberlin]

Hello,
I recently converted my systems running hpux 11.0 to trusted mode, and enabled password aging. The issue I have had so far is that there is no warning the a user password is going to expire. I am concerned that root will expire and lock me out of the machine. I am also concerned about accounts that may not have much login activity and will be locked out without ever knowing when they needed to be updated. Is there a way to find out how much time a user has until their password expires? Ideally I would like to run a script with my other daily info scripts, that would inform me before I have an issue.
Thanks

[Fred Ruffet]

Have a look at -w option (warn) in passwd man page.

Regards,

Fred

[Mark Greene_1]

Launch sam and select "users". In the "Action" menu item, select "Modify Security Policy". You'll have an option for "Password Aging Policies". One of the values there is for Password Exipration warning time. IIRC, this is a global value.

mark

[RAC_1 · Accepted solution]

man getprpw.

the setting expwarn controls the password expiry warning time. Setting it to 7 will inform/warn you for that last 7 days before password is to be expired. now you can put that entry in in script and have some calculation to tell that xx no. of days are remained, before password will expire.

Something like follows.

#!/usr/bin/ksh
typeset -i lif_time=$(/usr/lbin/getprpw -m exptm "user_name")
typeset -i exp_warn=$(/usr/lbin/getprpw -m expwarn "user_name")

typeset -i days_remained = $($lif_time - $exp_warn)

echo "days remained before pass expiry $days_remained" | mailx -s "Password exp info" user@abc.com

Script not tested, but should work.

Anil

[Deoncia Grayson_1]

Check out the -w option on passwd, it will work on a trusted server.

[Fred Ruffet]

You must also know if you want to script an automatic mailing, that last part of your encrypted password field in /etc/passwd represent the expire time.

Regards,

Fred

[Mark Greene_1]

Fred,

The embedded expiration time in the /etc/password file only applies to untrusted systems. I made the mistake of thinking I could rely on that when converting a system earlier this year.

See the man pages for modprpw and getprpw commands


mark

[Dave Chamberlin]

Thanks for the fast responses (This is still the best forum out there...)! The getprpw command has what I need (My system does not have a man page for it - but found the man page on the ITRC forum ). This will let me keep on top of things.