Password Aging on a non-trusted system

[Smucker]

I am looking into password aging on a non-trusted, non-shadow system (applications won't support these options)

This looks doable using the /etc/default/security file and updating the appropriate fields in the password file.

Has anyone done this? How did it go...any gotchas

[A. Clay Stephenson · Accepted solution]

I used it for many years before there were shadow files and/or trusted systems. If you were running NIS, the standard aging was all you had. The password aging subfields have functioned well for decades. You really don't need anything in /etc/default/security because password aging was working long before this file ever existed. The only gotcha is that eventhough you set the age and min time between changes in days, the actual resolution is one week because of the way the data are encoded. The weeks start on Thursdays UTC because 1-Jan-1970 was a Thursday UTC.

[Uday_S_Ankolekar]

/etc/default/security file has parameters called PASSWORD_MINDAYS and PASSWORD_MAXDAYS for aging restrictions.

man security for more information

-USA..

[whiteknight]

Hi Smucker,

Here is the solution to you. Please try it out, encourage you to use our Technical knowledge base.

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=emr_na-c01024352-2

Hope to receive 10 pts from you. ;-)

WK

[Smucker]

Any ideas on a warning system for the user....

[Ivan Krastev]

Set PASSWORD_WARNDAYS in /etc/default/security.

See this doc - http://docs.hp.com/en/B2355-60105/security.4.html


regards,
ivan

[Steven E. Protter]

Shalom,

/etc/default/security

Fully configurable. The is a man page on it and you can see the available features on that page.

SEP

[Smucker]

Sorry the WARN parameter works only with Shadow passwords..

[A. Clay Stephenson]

Since you didn't bother to identify your OS version, it's difficult to say what works on what version. The attached Perl script, pwwarn.pl, should work on any standard passwd system.

You don't even have to know any Perl.

pwwarn.pl mickey minnie pluto
would output:

mickey3
minnie0
pluto12

Indicating that user mickey, for example, has 3 weeks left before expiration.

Now, any child on the streets of Starkville, should be able to leverage who, write or mail to determine that a warning needs to be sent and craft a shell script (or Perl script). It could be part of /etc/profile or it could be a job that is cron'ed. If cron'ed, you probably want a file that keeps up with who has been notified any when because I would get rather annoyed if some stupid box told me every 20 minutes that I need to change my password. This script could also read /etc/default/security for a parameter whether the OS actually supports or not.

[Smucker]

Thanks I will user the perl program