HPUX passwords

[George Abraham_3]

Hello Admins,

When a user tries to change the password. it accept only complex passwords.

"Password must contain at least two alphabetic characters and
at least one numeric or special character."

There is no file /etc/default/security. I dont know why it is behaving like this. There are two password commands one in /usr/bin and one in /sbin but both behave the same.

Some users are complaining to make it simpler. I am trying to understand how and where these things are defined. The OS is 11i and is not in trusted mode

Any help will he appreciated.

thanks
George Abraham

[Sridhar Bhaskarla]

George,

That's the default. You don't need to have /etc/default/security file. Open up the man page of passwd command and read "password construction requirements".

On a personal note, I wouldn't entertain the requests from the users to make their passwords simpler. That is the minimum security in place without customizations.

/sbin/passwd is a security hole on 11.0 and previous systems. It is to be run by only root during the single user mode as /usr may not get mounted there. Change it's permissions to 700 and don't let users run it.

-Sri

[Manish Srivastava]

Hi,

You do not need to be in trusted mode to have the restrictions mentioned by you. Making the password simpler is not the right solution, this make it much easier to break. Simpler passwd as I understand is one which the user can think of and remember easily. Such passwds are easy to break and hence the restriction is put on what a valid passwd is.

manish

[George Abraham_3]

Thanks for the replies but i still dont know where the restrictions are comming from. Is that hard coded in the password command?

Can someone suggest some good links for understanding

1. How password authentication works in HP
2. What is trusted mode and its features
3.System hardening

Thanks in advance
George Abraham

[Bharat Katkar]

George,
Find doc attached on TCB.
Regards,

[Bharat Katkar]

George,
have a look at this threads which discussed about system hardening.

http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=92736

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=34888

Regards,

[Jose Mosquera]

Hi,

I've a non-trusted box on 11.0 and my passwd rules defined into /etc/default/security are:
PASSWORD_HISTORY_DEPTH=5
PASSWORD_MIN_UPPER_CASE_CHARS=2
PASSWORD_MIN_LOWER_CASE_CHARS=5
PASSWORD_MIN_DIGIT_CHARS=1
PASSWORD_MIN_SPECIAL_CHARS=0

Whit these rules max password length are 8 chars, where:
2 alpha-caps chars
5 alpha-noncaps chars
1 digit (numeric)
0 special chars

Also last 5 passwd are not allowed to set like new passwd.

Pls try to force this options according your requirements.

Rgds.