HP-UX 11.31 User password change min days = 3

[jason_lee]

Hi,
We have HP-UX 11.31 IA-64. We would like to have this security restriction:

"Minmum number days to elapse before a password can be changed = 3"

I used SMH to modify the System Default's "Security Attr. Config" for PASSWORD_MINDAYS=3
Then I create a new user, eg: user1
When done, in the "Detail view of user":user1.
....
....
PASSWORD_MINDAYS = 7

Why System value =3, User value =7?

Jason.

[Johnson Punniyalingam]

>>"Minmum number days to elapse before a password can be changed = 3"<<<

does it mean globel or only for particular user account

>>Why System value =3, User value =7? <<<

you need check /etc/default/security file


Hope this helps

Regards,
Johnson

[jason_lee]

Hi Johnson,

Of course, I would like it to be a global default, that's the reason I'm configuring it at the "System Default's security attributes configuration".

[jason_lee]

Hi Johnson,

grep MINDAY /etc/default/security | grep -v \#

PASSWORD_MINDAYS=3

So, back to my question, why the new user created have a PASSWORD_MINDAYS=7 instead?

[Johnson Punniyalingam]

Check below

See /etc/default/security

There is a man page and current settings can be viewed.

http://www.docs.hp.com/en/B2355-60103/security.4.html

http://docs.hp.com/en/B2355-60127/security.4.html

[Johnson Punniyalingam]

Download the pdf file of "HP-UX System Administrator's Guide: Security Management HP-UX 11i Version 3" from the below link.

http://docs.hp.com/en/5992-3387/5992-3387.pdf

[jason_lee]

Johnson,
I've already shown you, the content of /etc/default/security for PASSWORD_MINDAYS. It is already set to 3. Why the new user's PASSWORD_MINDAYS=7?

Any idea?

[Johnson Punniyalingam]

/usr/lbin/getprpw -l output what does its shows ?

[jason_lee]

Johnson,
man getprpw - "displays the user's protected password database settings ......This command is aval only to the superuser in a trusted system...

We didn't setup trusted system, does it mean that those "PASSWORD_XYZ" settings cannot work? I don't think so, since I've set those "PASSWORD_MIN_UPPER/SPECIAL/DIGIT/LOWER_ etc" & it is working. The system is enforcing the user to use a special characters etc when changing password.

Any other idea?

[Johnson Punniyalingam]

>>>man getprpw - "displays the user's protected password database settings ......This command is aval only to the superuser in a trusted system...<<<<

Above error Ok, becoz Its not trusted system or you are not "Super User" like root

[jason_lee]

Johnson,
That's not error, I'm showing you, it is from the output of "man".

Anyways, I'm running as root & we don't have trusted system enabled. My point is, since the given command will only work for trusted system, so, no point for me to run it right?

Why did you ask me to run that command in the first place? What's the relation to the problem I have?

[Johnson Punniyalingam]

>>>>>>>Why did you ask me to run that command in the first place? What's the relation to the problem I have?<<<<<<<<<<<<

I thought was trusted system which you running my BAD,

what else did you tried ? after you changed "PASSWORD_MINDAYS=7" to 3?

[jason_lee]

It seems the PASSWORD_MINDAYS only applicable to /etc/shadow password. Sigh...I'm not sure what's the impact of converting to shadow password to the existing applications.

[Johnson Punniyalingam]

You Just need Answer, You broke heart :(

I hope you never go through docs which was attached above

[Dennis Handly]

>It is already set to 3. Why the new user's PASSWORD_MINDAYS=7?

If you are not trusted, the default is in units of weeks. 3 gets rounded up to 7.
http://docs.hp.com/en/B2355-60130/passwd.4.html#d0e1054375

[OldSchool]

"It seems the PASSWORD_MINDAYS only applicable to /etc/shadow password. Sigh...I'm not sure what's the impact of converting to shadow password to the existing applications."

that's not correct. It should work with the std password file as well. The issue is that everything gets rounded to increments of 7 days.

try setting it to say, 10 days, and observe what happens. It will either reamin 7 or bump to 14 (I don't recall)