Password Management

[Dave_Moore]

Hi,
As part of an internal audit report we're being told that we need to have all our passwords reset on all our boxes every 90 days.

We have about 120 servers with numerous user ID's so I'm just wondering if anyone would know a good way of doing this?

We do have a large Windows domain with Active Directory so we could link into that but as far as systems management software goes we're hitting budget problems.

Would anyone here have a) A good money no problem solution and b) On a shoestring using things like scripts solution?

Also (I'll post a seperate question for this) as we now need to automate how we install patches to all our servers is there a package that could cover both of these requirements?

Most of our servers only run Weblogic / Oracle / Apache

Thanks,
Dave

[Steven E. Protter]

Shalom,

sam has a management feature depending on our OS version that can set up all users to have to change their passwords every 90 days.

Or you can use the passwd command to make a pass and force expiration and such.

while read -r DATA
do
username=$(echo $DATA |awk -F: '{print $1}')

passwd -f $username -n 7 -w 5 -x 90

done < copy of /etc/passwd

-f will force an immediate password change
-n will set the minimum times between changes to 7 days
-w will warn the user 5 days before expiration
-x will set the expiration at 90 days.

Problem solved.

SEP

[Steven E. Protter]

Shalom,

Forget your next question.

http://docs.hp.com/en/5992-4020/index.html
Patch management guide.

Seems based on your stated use of the systems user passwords are not a big issue. The auditors are just harassing you to justify their fees.

SEP

[Tim Nelson]

Another option is implementing LDAP on all these servers and authenticate with the PDCs.

I understand it is a challenge to get working but with 120 servers and alot of userids it just may be worth the effort.

And it is free. www.software.hp.com

[Dave_Moore]

Thanks for that, I think that's going to be the road we're going to have to go down but I'm wondering are there any central management tools we could install to give us a central management point? This should allow us to change password configurations / passwords from a central location.

The part of the question that I omitted is that I'm really looking for a way of automating this process. If we have to change the root passwords for example I'd like to have an app that could log on, change the password to a new password and then update a spreadsheet/database/whatever with the new password.

Would you recommend using a script with trusted ssh connections to do something like this or is there an expensive software solution that would do everything for us?

I've started a new thread in the patching forum and I'll add my new questions I've gotten from that great patching doc into that :o)

Thanks for the help so far, really appreciate it!

[Kenan Erdey]

Hi,

software i found:
http://www.symark.com/products/ppfaq.html

if you'd like to write your own script: consider to look at expect tool.you can find it here:

http://hpux.connect.org.uk/hppd/hpux/Tcl/expect-5.43/

Kenan.