Password Options in HPUX 10.20

[Mahadev Pednekar]

Hi,
I have a server installed with HPUX 10.20 and when trying to change the password of user through SAM, I am not able to get checkbox for "Force Password Change At Next Logon" in password option window. Is there any patch required for this issue ?.

Regards,
Mahadev

[Ranjith_5]

Hi Mahadev,

Can you try the passwd -f option to Force user to change password upon next login by expiring the current password.

Regards,
Syam

[Bill Hassell]

The location for changing specific user security policies (such as requiring a password change at next login) are found at:

SAM -> Accounts for Users.. -> Users

Select the user, then select:

Actions -> Modify Security Policies... -> Password Aging Policies

Then check the box for: Expire Password Immediately

Expiring the password will force the user to change their password at the next login.

[Ranjith_5]

Mahadev,

I dont think you can set the policies unless you make the system trusted. The options that Mr.Bill pointed, can only be used after making the system trusted.

Regards,
Syam

[Mahadev Pednekar]

Hi Syam,
You are right, set up polices can be done only when system is trusted. I havn't tried with passwd -f option. But the question is why that check box is not appearing where else check box is appearing in another server with o/s 10.2. Is there any patch required for this.
regds,
Mahadev

[Darren Prior]

Hi Mahadev,

I'd advise you to ensure that your SAM and trusted patches are the latest versions. Please also bear in mind that 10.20 is an obsolete operating system, so you shouldn't expect any future patches.

regards,

Darren.

[Bill Hassell]

Security policies are meaningless on a standard system. Your system must be Trustted for any of the policies to be displayed. The only way to force a password change on the next login (for a standard system is to change the password aging manually in the passwd file. Change the aging component to: .. as in:

billh:ul5dmLHEJxNfw,A203:103:20

to


billh:ul5dmLHEJxNfw,..:103:20

Your other system which does have the password expiration option may have the directory /tcb...if so, then that system is indeed Trusted.

[Mahadev Pednekar]

Hi Darren & Bill,
What is the patch no. for SAM ? and both the systems are not trusted means /tcb directory doesn't exists.
Regards,
Mahadev

[Ranjith_5]

Mahadev,

Can you tell me the method you are following to get this options pls.

the tcb directory is created during the process of trusting. So check whether the other machine is trusted. You can see your /etc/passwd file to verify this.

#cat /etc/passwd wiil give the similar output as follows. Means All the users will be having * in the password field instead of encrypted characters.

root:*:0:3::/:/sbin/sh
daemon:*:1:5::/:/usr/bin/false
bin:*:2:2::/usr/bin:/usr/bin/false
sys:*:3:3::/:/usr/bin/false
adm:*:4:4::/var/adm:/usr/bin/false
uucp:*:5:3::/var/spool/uucppublic:/usr/bin/false
lp:*:9:7::/var/spool/lp:/usr/bin/false
nuucp:*:11:11::/var/spool/uucppublic:/usr/bin/false
hpdb:*:27:1:ALLBASE:/:/usr/bin/false
www:*:30:1::/:/usr/bin/false

See SAM cumulative patch is installed / not.

#show_patches|grep -i sam

verify too
#check_patches

Cumulative sam patches for hp 10.20 are still available @ itrc.See this.Check all are there in your system.search in ITRC patch database.



Regards,
Syam

[Ranjith_5]

Mahadev,

I could find something. Force password change options will be available only in non-trusted systems as per my observations. Check whether your system is trusted or not. Else you will need to remove trusting for this option to make available.

Reply with your observations.

Regards,
Syam

[Darren Prior]

Hi Mahadev,

The latest patches for SAM and trusted for 10.20 are PHCO_8246, PHCO_8247, PHCO_12236, PHCO_17218, PHCO_22268. Please read the patch text for each of these, and also check for any required dependencies. There may well be other patches that you require too.

regards,

Darren.

[Mahadev Pednekar]

Hi Syam & Darren,
Both the systems are not trusted and verified by Syam method, also SAM cumulative patches are installed on both systems. As per Darren except PHCO_17218 & PHCO_22268 all patches are installed on both the system. I have verified the patches by command
#swlist -l fileset|grep -i .

regds,
Mahadev