Password history

[Tim O'Connell]

The auditors run a report on our HPUX 11.11 servers every & as the security is pretty good they usually come up with some request to justify their report. We are running a trusted system. This year they have asked to enable password history so that a user is unable to use a previously used password. Currently a user can change his password & after the "time between changes" which is 7 days has expired he can re-use his old password. Can't find anything in SAM. I know we do this in Windows but I am unable to find anything in HPUX. Cane some one help?

Thanks,

Tim

[Pete Randall · Accepted solution]

Tim,

Do a man on security and check the PASSWORD_HISTORY_DEPTH parameter. If you don't have one already, this will require that you create a file called /etc/default/security that will allow you to enable this.


Pete

[Senthil Prabu.S_1]

Hi,
Not sure, whether this will help you.

In solaris 10, password history can be enabled by using following parameter.

# grep "^HISTORY=" /etc/default/passwd
HISTORY=10

In this example, password history has been enabled and a user's last ten passwords will be remembered. So, if I user attempts to re-use a password that is in their history, the change will be denied and the user will be presented with the following message:

$ passwd gmb
Enter existing login password:
New Password:
passwd: Password in history list.

Please try again
New Password:


Hope u understand.
I guess same should be available on hpux.

HTH,
Prabu.S

[Jaime Bolanos Rojas.]

Tim,

You might want to go with Pete's answer:

You can modify the password requirements. See man security on 11.11

"PASSWORD_HISTORY_DEPTH
This parameter controls the password history depth. A new password is
checked only against the number of most recently used passwords stored
in password history for a particular user. A user is not allowed to
re-use a previously used password."

Regards,

Jaime.

[Bill Hassell]

The global security settings are kept in two locations, the /tcb directory (which SAM handles as well as the modprpw command) and the /etc/default/security file (which does NOT exist by default). The man page for security, getprpw and modprpw all go over the details. The attached security summary script will help auditors who are not familiar with HP-UX.

[Tim O'Connell]

Thanks for the quick responses. Will try /etc/default/security shortly. Points assigned.

Thanks,

Tim

[Tim O'Connell]

Sorted