Maximum Password Length & /etc/default/security file

[kirk humphries_1]

Hi All,

I wondered if anyone could provide me with some assistance. I have a HP-UX 11.0 workstation which has trusted mode enabled and the maximum password length is set to 8 characters. The system security policies are set such that system generated pronoucable & system generated random letter passwords are used.

When I create a user account using same the system generated password is 8 characters in length however when the user changes there password at first log in or if the administrator changes it the password length is 10 characters. All characters in the 10 character password are expected when the user logs in.

Is this expected action or a problem?

Whilst looking at the hp document website I came across details of the /etc/default/security file which has an option in it to set the minimum password length. Searching the workstation, I am unable to find this file. Can anyone tell me if is generated when first loading HP-UX or is it something that needs to be added manually?

Thanks in advance.

Kir

[Justo Exposito]

Hi Kir,

I don't have this file in my systems, so this is a file that you must create.

This is from the passwd man page:
Password History
On systems with PAM patch PHCO_13808 or later the system administrator
can enable the password history feature to discourage users from
reusing previously used passwords. To enable the password history
feature, the system administrator should create a file (or open the
file if it already exists) named security under directory /etc/default
and append to it one line content PASSWORD_HISTORY_DEPTH=number. The
line contains three keywords, PASSWORD_HISTORY_DEPTH, =, and a decimal
number which is the desired depth for the password history check. If
the number is 2, the user's new password will be checked against two
previously used passwords. One is the current password, and the other
one is the password used before the current password. A configuration
of password history depth of 2 prevents users from alternating between
two passwords. The maximum password history depth supported is 10 and
the minimum password history depth supported is 1. A depth
configuration of more than 10 will be treated as 10, and a depth
configuration of less than 1 will be treated as 1.

The password history depth configuration is on a system basis and is
supported in trusted system for users in files repository only. This
feature does not support the users in NIS or NISPLUS repositories.
Once the feature is enabled, all the users on the system are subject
to the same check. If the password history configuration file
/etc/default/security does not exist, or if the file exists but the
required line is missing, or if the line exists but any of the three
required keywords is missing, the password history check feature is
automatically disabled. When the feature is disabled, the password
history check depth is set to 1 and a password change is subject to
all of the other rules for a new password including a check with the
current password.

Regards,

Justo.

[doug hosking]

Note that the /etc/default/security file was introduced after the original release of HP-UX 11.00. The number of options settable in this file is growing, but not all of them will work in the older releases like 11.00.

On HP-UX 11.11 and later, there is a security(4) manual page that describes what settings are supported in any given release. For HP-UX 11.00, or for features added in patches, you will generally have to look at the documentation for the relevant patches to find information on which /etc/default/security options are supported. (Of course, these will
be documented in the man page in subsequent
releases.)

A template for /etc/default/security is not shipped in HP-UX 11.11 or earlier. In subsequent releases a commented template will be shipped.

[kirk humphries_1]

Hi,

Firstly my apologies for not replying sooner. Thanks for the replies, they provide useful information.

Regards

Kirk