Password Aging Policy in a trusted system

[Joyce Suganthy]

Hi

I have a question here.

In a trusted system environment, if an ID , say IDA is disabled because of password aging policy. Can you actually login using another id, say IDB (not disabled) and use the 'su' command to log into the system as IDA?

Please help and advise

REgards
Joyce

[Bill Hassell · Accepted solution]

Nope. That wouldn't be very secure if it worked would it? Only root can change a disabled or deactivated user account. If this is a pain to do and you need help, do NOT give the root password to anyone. Instead, get a copy of sudo and setup a very restricted use of thew special SAM command /usr/lbin/modprpw. Otherwise, look at restricted SAM to allow some users limited access to SAM's features.

[Rajeev Shukla]

Yes you can login to the user whose accounts password has aged, when you login it will ask you to change the password. But you still can not su by another user, you'll have login as himself, change the password then it will work.
If the account is inactive then you can not login as another ID also.
If the absolute account life time has expired then also you can not login as nother ID

[T G Manikandan]

There are 4 parameters in the password aging of trusted systems,

Time Between Password Changes
Password Expiration Time
Expiration Warning Time
Password Life Time

The account is disabled only when the password life time is crossed and the root user has to enable the account.

If the account is disabled you cannot login or do a su.That user is not accessible.

Meanwhile if the scenario is different like the user account is not disabled i.e not crossed the password life time then a password change is required for the user.Still only the super user can 'su' to that user and normal users cannot do that as the password is expired and requires a fresh one.