password expiry notification

[Stan PIetkiewicz_1]

HP-UX 11.0 on Nclass - set password notification in SAM to 10 days but users are NOT being notified until their passwd expires. Checked and the setting in 'system security policy - password aging policy' is for 10days - any idea what might be preventing the warning from being generated according to the setting?

[RAC_1]

Are you in trusted mode?? It is good to convert to trusted mode. IT offers lot of other security related features.

/usr/lbin/modprpw -m expwarn "user_name"

If not then you will have to do some scripting.

passwd -sa to get the information about when it is expiring and then calculating how many are remaining and sending an email.

Anil

[Sundar_7 · Accepted solution]

I believe password expiry warning is only possible in trusted system.

If you already have your system trusted then set this system wide password aging warning policy using modprdef

/usr/lbin/modprdef -m expwarn=5

Your users will receive a mail 5 days prior to the password expiry date.

[Sridhar Bhaskarla]

Hi Colin,

Only users on the trusted systems will be notified on password expiry including their last successful/unsuccessful logins. Sometimes it may scroll so fast that you may not see the message during the login.

-Sri

[Rodney Hills]

If you use "PAM" (see man pam) and the server you validate against has password expiraration, login will honor it as well as force password change on next login.

HTH

-- Rod Hills

[Stan PIetkiewicz_1]

Thanks for the suggestions ... not even a man page on modprdef. Did go ahead with the setting to 10 but still wonder why SAM did not work it. We are on trusted. Maybe SAM patch?

will be testing the setting to see if it works now.

[Darren Prior]

Hi Colin,

modprdef is one of the backend commands used by SAM - these are rarely documented as they are intended to be used only by SAM, but they can prove useful.

regards,

Darren.

[Sundar_7]

Colin,

modprpw and getprpw are documented in HP-UX 11i.

modprdef and getprdef are not documented even in 11i.

I am attaching the getprdef man page I received from some source.

HP will tell you this is not supported but it works and nobody wants to use SAM to set the custom password aging for selected set of 750 users :-).

Good luck

Sundar.