password policy in a non-trusted system

[sheevm]

Hi!

We are runnng hp-ux 11.0 on L2000 machine. This is non-trusted system. I am trying to implment passowrd policy. I was told to create /etc/default/security file and add the following lines and this should take care. But it is not working. Can someone out there tell me what else I need to do. I want to set passord plocy: atleast min 7 Chars and one digit.
vi /etc/default/security

MIN_PASSWORD_LENGTH=7
PASSWORD_MIN_DIGIT_CHARS=1

Thanks.

[Pete Randall]

Do you have PHCO_24606 or later installed?

How is it failing? Do you mean that you can set a new password using the passwd command that violates one or both of these requirements?


Pete

[Oliver Schmitz]

some information maybe in the discussion I invoked an hour ago.

Hope it helps,

Oliver

[Pete Randall]

The discussion Oliver is referring to would be this one:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=857287


Pete

[Oliver Schmitz]

sorry, forgot to post the link...

[sheevm]

I read the conversation. Please pardon me!!

Can I just use the /etc/default/security file in a non trusted system to satisfy above password policy requirement?

Our's is non trusted system.

[Oliver Schmitz]

Yes you can set some policies as described in man security. Some more advanteneous policies are included in the trusted system and if you refer to the passwords only a shaddow tool in addition to a non-trusted system would be helpfull to harden your system. In trusted systems auditing tools and some more flexible policies for passwords etc are included and helpfull. I just converted my maschine today and it was straightforward and very comfortable, no errors so far. I did it with SAM!

Regards,

Oliver

[sheevm]

Thanks to all of you.

Pete,

It is stll failing. Yes even with this config it is violating the above rules. I can still cretae passord of 4 letters.

I am not sure what else to do.

Does this require reboot?

Thanks
Raji

[sheevm]

Hi everyone,

It is working now. Now I have to force all the users to change the old passwords in their next login. Instead of doing individually in SAM is there a way I can write a script? Does anyone has any script which can satisfy this requirement?

Thanks.
Raji

[RAC_1]

/usr/sbin/logins -u | awk '{print $1}'|xargs passwd -f

man passwd for details.

Anil

[A. Clay Stephenson]

This should do it (looks for all UID's > 100 and passwd != '*'):

#!/usr/bin/sh

INFILE=/etc/passwd
awk -F ':' '{if (($3 > 100) && ($2 != "*")) print $1}' ${INFILE} | while read U
do
echo "User: ${U}"
# passwd -f ${U}
done


When you are satisfied that the correct users are being selected, uncomment the passwd -f command.

[sheevm]

Thanks for your help. It is all set now. I am unable to assign points, do not see the button. Any hints?

Thanks
Raji