Password expiration procedure

[Renante M. Yu_1]

Hi to all,
Is there a way to modify the password expiration notice for HPUX? after the C2 conversion, users were confused that once their password has been expired, the system prompts them to enter the old password, supposedly you just re-enter what you have entered before the message "Your password has been expired".. majority of my users were mistakenly using their previous password and not the password they have entered before it expires. I noticed every first week of the month, i encounter a lot of enabling request form users.

[Steven E. Protter · Accepted solution]

You can enable(trusted system for sure) a warning message, saying that the password will be changing in x number of days. Thats a standard setting in sam security ....

You might want to modify /etc/issue and add an explanation of what happens when the password changes so the user understands.

Standard behavior is it prompts for the current password, then does the old password thing like you are seeing.

The wording can be modified.

You can try a "Tip of the day" notice to users and modify any user guide you hand out.

In the end, I've found that no matter how much money the user makes or how smart they supposedly are password change will generate calls. Its a fact of life.

SEP

[Renante M. Yu_1]

Hi SEP,
How will I enable the warning message so that user may know when his/her password would expire? by the way, the version is HPUX 11.00. And also, you mentioned that I can modify the wording of "OLD PASSWORD" I am planning to change it to "PLEASE RE-ENTER YOUR PASSWORD".

Thanks again SEP. Your advise does really help. More power to you.

Regards,

Teng

[Bill Hassell]

You can setup the leadtime for the password warning byu running SAM and selecting Auditing -> System Security Policies. There is no way to change the wording as it is hardcoded in the /usr/bin/login program.

However, there is a way to notify your users (don't ever use /etc/issue since it is displayed BEFORE the user logs in) about an upcoming password expiration. The command /usr/lbin/getprpw will return just about anything you would like to know about a specific user's password and login features. However, it is a super-user command and is found in the 'backend' directory /usr/lbin which means that it is subject to changes without warning. So you would have to run the command in cron once a day to populate a simple file with the user's login and the expiration date. The cron job should also compute the number of days before expiration using the caljd script mentioned so often here in the HP-UX forums.

Once this file is created on a regular basis, modify /etc/profile to find the user in the file, check to see that the number of days until expiration is less than 5 (or 10?) and warn the user as they login. This assumes that user perform a 'normal' telnet login that runs /etc/profile on login.

[Sridhar Bhaskarla]

Hi,

It can be easily accomplished by using SAM. Through command line, use "modprpw" for individual account settings and "modprdef" for systemwide settings. For ex., to unexpire the user accounts after the conversion use the command

/usr/lbin/modprdef -m "exptm=0"

There is an option available to warn the users before the expiry. Following command will warn (expwarn) the users 20 days before the expiration period (exptm) say 100 days.

/usr/lbin/modprdef -m "exptm=100,expwarn=20"

Look at docs.hp.com website for man page of getprpw, getprdef, modprpw, modprdef commands.

-Sri