OpenSSH and TCB

[Karen Shen_1]

On hpux 11.00 server with TCB enabled and openssh 2.5.1p1 installed, users will be forced to change password as set up when they login using telnet. But this is skipped/by-passed when they use SSH.

Any idea why and how to prevent it?

Thanks!

Karen

[Andrew Cowan]

Hi Karen,

Unfortunately this is the same situation on all Unix platforms as SSH is written to be as generic and portable as possible. In order to generic the authors could not easily tie SSH into each OS's password ageing system.

You also have the same situation if you use keys to login, and there's nothing to stop you choosing a passphrase of /Nothing, and there is no history management or timeout.

The only solution I can offer is to only allow users to SSH to other unprivileged users, and then "su". You can then enforce the password ageing on those accounts, and you also have a record of who used them, and when.

Andrew

[John Bolene]

just hit submit once and wait

for some reason it comes back almost immediately but it is not done

[D. Jackson_1]

I think this has been added as a "feature" in the latest openssh release..

GooD LUck

[Andrew Cowan]

Hi John,

Thanks for sorting out my duplicate posts. Sometimes when I press submit I can wait for 20 minutes and then get a "page not found" error, and perhaps nothing is posted. Here at the bank we have an E3 connection so it should (and 90% of the time does) happen pretty-much instantly, however every now and again it seems to go pear-shaped.

[Steven Sim Kok Leong]

Hi,

Your version of openssh is extremely old. You should upgrade it to the latest which fixes quite a number of security issues since openssh 2.5.1p1.

As for your question, offhand, I believe you can workaround this limitation by writing scripts to interface your system login scripts with /tcb files. With a combination of trap signals used in your script, you should be able to enforce password changes.

Hope this helps. Regards.

Steven Sim Kok Leong