Password history Depth

[Nick D'Angelo]

All,

HPUX 11i

I am trying to setup the Password_history_depth so that users will be prevented from re-using the previous 6 password.

I have added the file /etc/default/security and included the line: PASSWORD_HISTORY_DEPTH=6 in it and it is readable by everyone.

However, I have experimented on my test server with one user account and it did not remember the previous password, therefore I do not believe it is working as expected.

Did I miss something?

Thanks

[Pete Randall]

Nick,

According to the man page, this feature "is supported in trusted system for users in files repository only. This feature does not support the users in NIS or NISPLUS repositories."

Are you on a trusted, non-NIS system?


Pete

[Nick D'Angelo]

Thanks, NO NIS or NISplus is being used.

[HGN]

Hi

This feature works only in trusted mode, you can change the system a test system to trusted mode and see if that works out for you.

Rgds

HGN

[Bill Hassell]

The password history for each user is stored in /tcb/files/auth, so if you don't have this directory, your system is not Trusted and virtually none of the password controls mentioned in the security man page will work.

[Sunil Sharma_1]

Hi,

Please see man page of security. It says " The pasword history depth configuration is on a system basis and is supported in tructed system for users in files repository only"

So this can be possible in trusted mode only and If you are using files then only. It does not support NIS

Sunil

[Nick D'Angelo]

Thank you all.

Bill H - question

What if I don't have a /tcb/files/auth etc directory? Can I just create one?

[Pete Randall]

You'll need to convert your system to trusted, either by going through SAM (recommended) or running tsconvert.


Pete

[Bill Hassell]

Nope. /tcb is the Trusted Computing Base directory and is meaningless without the Trusted conversion. Go into SAM and select Auditing and Security. You'll be asked to convert to Trusted. NOTE: is you use tsconvert (which is hidden in /usr/lbin) all the passwords will be expired immediately. SAM will enable all the logins. Note also that if anyone user on your system (including root) has a password more than 8 characters, during the conversion the password will be honored only when 8 characters are entered. If you enter more, it will be rejected. This is because your un-trusted system silently ignored the extra characters.

Once converted to Trusted (takes a minute or so), SAM will now have additional features including system-wide security policies including password history.

[Nick D'Angelo]

Peter, thank you.

Will it require a reboot?

[Bill Hassell · Accepted solution]

Nope, no reboot necessary. Existing user sessions are untouched, new users can login with no visible differences except they will now see when they last logged in successfully and when they last failed to login successfully.

[Nick D'Angelo]

Hmm, it errored with a -1 while trying to configure this on my test server using SAM.
This was the error:

he attempt to convert this system to a trusted system failed. The x x
x [x command return value was "-1" and the standard error output was: x x
x x Can't write protected database; x x
x [x password file unchanged.

??

[Nick D'Angelo]

Sorry All, I was a little too quick to post my error.

I found a user account in /etc/password that had a # as its first character. Once I removed this, and re-ran Sam - it converted to a trusted host no problem.

THanks anyhow.

[Pete Randall]

Are you running short of space in your / file system? Run a bdf and check.


Pete