Password aging/expiration causing lockout in database session

[Geoff Lawson]

OS: HP-UX B.11.23 U ia64
Security: Trusted System

I'm running into an issue with password aging. Issue is that the password expiration time will occur while the user is logged in (yes - they ignore the change password prompting) which will cause the database authentication to fail and locks their database/application. What I want to know is if it is possible to set the expiration time to be 12am – so when the user logs in on the day of expiration – they will be forced to change it right then. I understand I can add logic to check and set all this in the login scripts – however, I’d prefer to do this in the security settings.

Thanks!

[Tim Nelson · Accepted solution]

Set it the first time at 12am.

Then x days later it will expire at 12am. ( I think )

Really not sure if the expiration clock uses hours or just days.

Why not try it. Set up a new login, set it to expire in a day. Login an hour or so before the creation and see if it is expired. log in a hour or so after the creation time and see if it is expired.

[Geoff Lawson]

Great suggestion - I'll try that.

My concern is the clock will change when they reset their password at 9am the next change - I wonder if the following expiration will occur at 9am - causing the lock again.

I did find reference to an option with modprpw that may work out well:

modprpw:

-V This option is specified WITHOUT a user name to
"validate/refresh" all user's passwords. It goes through the
protected password database and sets the successful change time
to the current time for all users. The result is that all user's
password aging restarts at the current time.

May be combined with one of -l or -n options.