Pre-empting Password expiry on HP-UX

[Nick Wickens]

I need to be able to identify that a password will expire during the current day when a user first logs in that day. (This is to resolve an Informix issue where Informix denies service at the exact time the login expires even if they are logged in at the time !). I run a trusted system and hoped that I could do this by looking at the last update times of the files in /tcb/files/auth/?/* but find that this gets updated at login time as well.

I was wondering about setting and capturing the warning message ?

[Steve Faidley]

You should be able to set the expiration warning time so that the user knows their password will expire within a day/week etc.
You can use the undocumented command;
getprpw -m exptm to list the expiration time.
The "unreleased" man pages for getprpw and modprpw have been posted in forums before. If you need a copy let me know.

[Carlos Fernandez Riera]

IRW:

passwd -s user ( status of acount)

You can force password expiration w/ passwd -f and that login sends a message a week/days before password expire.

See man passwd

[Nick Wickens]

Thanks for the help guys - Sorry should have mentioned that this is on a 10.20 system and the "-s" system seems to be an 11.00 enhancement (at least it exists on my test 11.00 system but not on 10.20).

As far as the getprpw command a copy of the man pages would be appreciated thanks.

[Joseph Wynn]

We have a similar situation, but in our case, the user no longer logs into the HP-UX system, they are using a web portal to access the information. They use their active directory account to authenticate to their web portal account. Unfortunately, if their HP-UX account becomes expired, then Informix will not allow them to have access to their data.

Has anyone addressed this issue where Informix is used, and the user no longer logs into the Unix system - therefore not getting prompted for their password change?

[Zinky]

You've a trusted system so you can make use of the getprpw command.. of utmost use would be the "slogint" and "lockout" fields. Do a man page on "getprpw".

/usr/lbin/getprpw -r -m lockout idba

/usr/lbin/getprpw -r -m slogint idba

Or you can even get the various time fields of the account if you've set them apart from the defaults.

[Sridhar Bhaskarla]

Hi Nick,

Look at the following thread. I posted a script that can be used to get the 'number of days before the password will expire'. If it is less than 2, then you can send a message or notify during the login so that the users can change their passwords. You can tailor it further to accomplish what you want. There are also few more solutions in the same thread.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=696912

-Sri

[Bill Hassell]

getprpw is documented at http://docs.hp.com as well as 11.11 but the man page applies to previous versions back to 10.20. The extra passwd options were only added to 11.0 and later.

[Steven E. Protter]

Real Systems Administrators don't use GUI's

Guess I'm not a real one. But for my database binary owner, I simply use sam users and then modify the user turning off password aging.

When I want to change the password, I initiate the process and update the appropriate people.

Every once in a while one of my backups decides thats a bad idea and changes it back, but thats what I do. I have the same policy on root since an operator doing the one task they need root for decided to answer a prompt for password change and tell nobody.

That adventure required a trip to single user mode to fix.

Informix, Oracle and other database vendors are now pushing a single sign on concept where they accept authentication from and LDAP server, or even Windows ADS. In that scenario once the user is on the network they have access to the Informix database.

SEP

[Nick Wickens]

Hi All

I don't know if anyone else noticed but I raised this back in April 2001......?

I solved the problem back then by setting up my own scripted procedures to expire passwords at midnight if they had not been changed for 30 days. That way the user always has to change first thing in the morning rather than midway through the working day. As far as Informix is concerned with connections not making actual Unix login I tend to also disable logins not used for 30 days automatically - does mean that the user is inconveninced whilst its reactivated but does ensure password changes do take place on these accounts.

I will assign points to those who replied but I think that the "re-animater" of this thread should have started a new one really so no points there :@). (I see its no possible to lock threads which is a good idea).

[Nick Wickens]

Closed