Password History

[Jim92900]

Hi,

I am on a trusted machine, i need to find out the password history size. Is this the same as the passwd_depth_history file. If not where do i look into.

Thanks,
Jim

[A. Clay Stephenson]

The maximum number of stored passwd hashes is determined by the "PASSWORD_HISTORY_DEPTH" value stored in /etc/default/security. Of course, the actual depth for a given user may be much less than that simply because the user has not yet changed his password that many times.

[Steven E. Protter]

Shalom Jim,

By default, PASSWORD_HISTORY_DEPTH is not implemented on HP-UX.

Therefore unless the system has been changed to keep this information you will have no data to look at.

If the system is trusted this can also be set up with sam.

Is the system trusted?

SEP

[Jim92900]

Yes the machine is trusted, is the password histroy size and the password_depth_history represents the same or different.

Thanks,
Jim

[A. Clay Stephenson]

There is no way to answer your question because "password_depth_history" means nothing. PASSWORD_HISTORY_DEPTH is a value stored in the security file and that does determine that maximum number of password hashes that will be stored per user to prevent reuse of old passwords prematurely. However, there is no way (at least without writing a C routine to determine the current history depth for a given user). Man 4 security for details.

[Jim92900]

I am sorry, its a typo what i meant was Password_History_depth is it the same as same as password history size.

The reason I am asking is that, I am running Axent Policy which says that the account password history size is disabled. What should i do. Do i need to change the Password_History_Depth=N for the password history size.

Thanks,
Jim

[A. Clay Stephenson · Accepted solution]

I have no idea what Axent Policy uses to determine is password history is in effect but if you set PASSWORD_HISTORY_DEPTH=8 in /etc/default/security then a given password cannot be reused until the password has been changed 8 times.

When combined with the mintm (minimum time beween password changes) stored in each user's TCB entry or taken from the system-wide default value (/tcb/files/auth/system/default) if not defined for the user, the PASSWORD_HISTORY_DEPTH can then tell you the minimum time before a password can be reused.


You can actually examine the password history by looking at the files under /tcb/files/auth/system/pwhist although you have to understand the bigcrypt() function to understand what you are actually looking at.

[Steven E. Protter]

Shalom,

PASSWORD_HISTORY_DEPTH

Only relevant parameter.

As to whether this conflicts with other configuration, you'll just have to test that.

SEP