password history on HPUX

[Alec B. Toting]

is there anyone done this
using shell scripts. I know the OS doesnt keep password
history. can anyone help?

[Michael Tully]

Hi,

You can if you set your system as trusted and implement the below.

Password history check of up to 10 passwords.
The system administrator can enable the password history feature to discourage users from reusing previously used passwords. To enable the password history feature, the system administrator should create a file
(or open the file if it already exists) named
/etc/default/security and append to it one line containing:

PASSWORD_HISTORY_DEPTH=number

The line contains three keywords: PASSWORD_HISTORY_DEPTH, =, and a decimal number which is the desired depth for the password history check. If the number is 2, the user's new password will be checked against two previously used passwords. One is the current password, and the other one is the password used before the current password. A configuration of password history depth of 2 prevents users from alternating between two passwords. The maximum password history depth supported is 10 and the minimum password history depth supported is 1. A depth configuration of more than 10 will be
treated as 10, and a depth configuration of less than 1 will be treated as 1.
The password history depth configuration is on a system basis and is supported in trusted system for users in files repository only. This feature does not support the users in NIS or NISPLUS repositories. Once the feature is enabled, all the users on the system are subject to the same check. If the password history configuration file /etc/default/security does not exist, or if the file exists but the required line is missing, or if the line exists but any of the three required keywords is missing, the password history check feature is automatically disabled. When the feature is disabled, the password history check depth is set to 1 and a password change is subject to all of the other rules for a new password including a check with the current password.

To set your system as trusted, use either 'sam' or from the command line '/usr/lbin/tsconvert'
Beware that doing this will expire all passwords on the system including 'root'.

HTH
Michael

[Michael Tully]

As far as I know it can be done the same on 10.20, 11 and 11i.

[doug hosking]

Michael, I'd be really surprised if this
worked on 10.20. PHCO_13808 was a patch
to 11.00 that added this functionality. A side effect of that patch was the creation of the /etc/default/security infrastructure, which has been used by many other extensions in later patches to 11.00 and 11.11. The library being patched was not used by
the passwd or login programs before HP-UX 10.30 (11.00, for most customers), nor did /etc/default/security exist in 10.20.

[Patrick Wallek]

If you are on HP-UX 10.20 then check out patch PHCO_25591.
http://www1.itrc.hp.com/service/patch/patchDetail.do?patchid=PHCO_25591&context=hpux:800:10:20

It is the latest login cumulative patch and it does mention the /etc/default/security file.

[doug hosking]

Yes, very limited support of /etc/default/security was finally backported to 10.20 several years after the password history code went into 11.00. But the actual enforcement of password history rules takes place in libpam_unix, which was only used by CDE in 10.20 if I remember correctly.