limit password length in hp-ux 11i v1

[rana786]

Hi all,

I need to limit maximum and minimum password length. How can I do that? Do I need any patch to install for enabling this feature?

Best regards,
Rana

[Patrick Wallek]

You need to make use of the features available in the /etc/default/security file.

# man security

for details.

Also, make sure you system is trusted. That will give you more control as well.

[Steven E. Protter]

Shalom Rana,

/etc/defaults/security

Its a wonderful little file that lets you let complexity and length guidelines on HP-UX.

No patches required.

SEP

[rana786]

Hi Patrick,

Thanks for reply. I do not have this file in my system but I can do man security. Do I need to create this file in the said path? Is it possible to configure this file according to my requirement keeping system untrusted? Please explain a little more?

Best regards,
Mostafa

[Hein van den Heuvel]

>> Is it possible to configure this file according to my requirement keeping system untrusted

Ah, you want your system to be 'a little bit pregnant' !?

I guess you ask the question to try to meet an audit requirement? Well, what's behind the audit requirement? Is it really only about the 'rubber stamp of approval' or a trigger to set up a (more) trusted environment.

Good luck,
Hein van den Heuvel
HvdH Perfomance Consulting

[James R. Ferguson]

Hi Rana:

> Do I need to create this file in the said path? Is it possible to configure this file according to my requirement keeping system untrusted?

Yes, you need to create the file named '/etc/default/security' if it doesn't already exist. The manpages detail the options and caveats.

Unless you are going to convert your system from an untrusted to a trusted environment, your mininum and maximum password length will be limited to 6-to-8 characters. Trusted systems allow the minimum length to range from 6-to-80.

Since untrusted systems enforce a password length minimum of six (6) for non-root users, the use of the '/etc/default/security' file on an untrusted system to alter password length doesn't offer more than a two-character increase to a minimum of eight (8). Too, only the first 8-characters of a password are significant on an untrusted system, so both your minimum *and* maxiumum size cannot exceed 8-characters thereon.

Certainly, however, there are other features and reasons to (1) enable the 'security' file (see the 'security(4)' manpages); (2) convert to a shadow password file (see the manpages for 'shadow(4)'); or (3) convert to a trusted system.

If you read the 'security(4)' manpages with these choices in mind, you will see that some of the configuation options for the 'security' file require either a shadow password environment or a trusted one.

Regards!

...JRF...

[Bill Hassell]

You must create the security file (there is no default). But as Hein mentions, an unTrusted system will not meet any modern security audit. And if you look at the man page for the security file, you'll see the almost all options are non-functional if the system is not Trusted, things like password history, requirements for MiXeD case, numbers and special characters, etc.

[rana786]

Thanks.