passwd

[Constantine_1]

When new account is set
Users receive the default password
How can I check that the password was changed
We don't have trusted server setup and no ageing on our machines

[Constantine_1]

And how will I make sure that the user not using the same default password

[Steven E. Protter]

passwd -sa
will provide you some data.

SEP

[Leif Halvarsson_2]

Hi,
You can force the user to change password at next login. Check the password option in SAM/Accounts for Users and Groups.

[Steven E. Protter]

passwd -f

Will force the user to change the default password at first login.

SEP

[Mark Grant]

You could copy the passwd file and compare it with "diff" to the real one from time to time.

However, if you put ",M0" at the end of the encrypted password for the user in /etc/passwd, they will be forced to change there password when they first use it but it won't force them to change it again later. In other words, it doesn't implement password aging but does ensure that the original password gets changed.

[Umapathy S]

Constantine,

In SAM, create the user account with the option "Force passwd change at next login" under Set Password options.


HTH,
Umapathy

[A. Clay Stephenson]

This is a bit tricky given that a user could change his password back to the default value but there is a way to do this rather easily (and in fact given that a user could revert to the default password) should be done for all users periodically.

I would use Perl to extract all users from the passwd file and then call getpwnam() to get the hashed passwd word, extract the 1st 2 chars of this field and this bemomes the 'salt' value. Now
call crypt() using your default password and the $salt value and if that hash matches the hashed passwd found in /etc/passwd then the user is using the default passwd.

Very easy Perl script.

[GK_5]

passwd -f loginname will force to change the passwd at next login

[Constantine_1]

Forcing the users to change the password that's not a problem
Finding who should change that is a problem

Any Ideas how I can take default pasword and compare to what users have

[Jayan_2]

Dear ,


See directly to the /etc/passwd file.

regards
Jayan

[A. Clay Stephenson · Accepted solution]

Okay, here is a 2 minute Perl example:

#!/usr/bin/perl -w

use strict;

use constant MIN_UID => 101; # no need to check values below this
use constant DEFAULT_PW => "secret";

my ($name,$passwd,$uid);

setpwent();
while (($name,$passwd,$uid) = getpwent())
{
if ($uid >= MIN_UID)
{
my $salt = substr($passwd,0,2);
my $hash = crypt(DEFAULT_PW,$salt);
if ($hash eq $passwd)
{
printf("User %s (UID %d) is using the default passwd %s\n",
$name,$uid,DEFAULT_PW);
}
}
}
endpwent();

Just set to DEFAULT_PW constant to your value and it will work. It will even work with NIS/NIS+ or plain /etc/passwd.

[Leif Halvarsson_2]

Hi,
Copy the crypted default passwd from the password file, in my example it is "sNiloRtBTvMzI".

awk 'BEGIN { FS=":" } $2 == "sNiloRtBTvMzI" { print }' /etc/passwd

[A. Clay Stephenson]

Unfortunately, Leif's approach is not very robust because the user could change the passwd back to the default value using the passwd command and because a new "salt" value would be randomly chosen the values would compare differently even though the plaintext passwds are identical. You really have to extract the "salt" from the passwd field and run it through crypt and compare that result to the original.

[Leif Halvarsson_2]

Hi,
Yes, I discovered that. Sorry, it was not a good solution.