Prompting before password Expiry !!!!!

[Justin_132]

Hi Admins,

Is there any method other than mailing, a HP Server should prompt for password expiry warning when a user logs in. Just like what we have in windows....

Just-In

[Con O'Kelly]

Hi Justin

If you are using trsuted systems there is a message that alerts you when your password will expire. Not always obvious as it gets lost in all the other login messages.

It is set via the "expwarn" parameter.
For example expwarn=7 means it will warn 7 days before password expiry.

You get/set the value through SAM or using /usr/lbin/getprpw and modprpw commands.

Cheers
Con

[Justin_132]

Hi Con,

Already I gotta those settings done. My problem is users often comes to me and asks for unlocking their accounts. The following settings i had :

- Lock after 3 unsuccessful logins,
- Password Expiry period - 30 days,
- Expiry Warning - 7 days and etc...

I wanto overcome this locking issues. Any solutions. Its a trusted one.

Just-In

[Con O'Kelly]

Hi Justin

I'm not aware of any method of doing this in HP-UX. Maybe others are?
HP-UX will warn users their password will expire but won't prompt them to change it.

One idea - You could write a script (that looks at /tcb parameters) and include it as part of the user .profile. If their password is due to change in less than 7 days then prompt them to change it etc.

The script will need to check when the users last changed their password (u_succhg), then look at their password expiry (exptm). From that work out the next passowrd change time and compare to current time and so on.

Hope that gives you some ideas

Cheers
Con

[Victor BERRIDGE]

Hi Justin,

Difficult to answer, not knowing your site and users habits but I see 2 options:
change the - Password Expiry period to 60 days

That will reduce by half the issue during the same period of time (well...)

Write a script that you call in .profile that once from only 5 days left will "force" the user to change his password...

But I wonder if your issue is not more a question of people that did not connect themselves during the expiricy warning period
(e.g. vacation or illness...) in which case setting (maybe the lock after to 5 ) - Password Expiry period - to 60-90 days AND Expiry Warning - to 10 days may solve most....


All the best
Victor

[Cem Tugrul]

Justin,
i am agree with Victor but the q is here
we do not know your env.i mean do your users
connect to system via telnet-web base-etc
????
but in the past i had same problem but i solved it.i have production system running
oracle+BaaN application.My clients use a
baan client gui software which installed every client so this software has a gui
username=
passwd=
of course the username&passwd from my hp-ux
accounts.
As i said i solved the problem with my
baan developer colegue.i have written a script like and scheduled every 5 minutes from root cron;

for USER in `listusers | awk '{print $1}'|egrep -v "baycom|baanmail|bsp|dummy|elan|mailuser|mantr|rvs|smbnull|sshd|tbase|tftp|usertl
"`
do
/usr/lbin/getprpw $USER >/users/usrpas/$USER.pas && chmod 777 /users/usrpas/$USER.pas
done

so this means i collect information for each user and redirect to a file
then my baan developer colegue wrote a program which reads this values and generates message after user connects to baan GUI software.

Maybe this solution looks primitive but
it works for me and for my env.

Good Luck,

[Sยภเl Kย๓คг]

Hi,

You need to tune your truted system policies to ensure that, it won't trouble the users much. As you have set the account lockout retry max as 3, when a user tries wrong password for more than 3 times, his account get disabled. What you can do is to educate teh users about the security policies implemented in your system.

Or else, change Unsuccessful Login Tries Allowed to, may be 9 or 10 in General User Account Policies.

Educating the user will the best option, as most of the companies follow, it's own audit secuirity policies.

Regards,
Sunil

[Arturo Galbiati]

Hi Justin,
I'm using a script which notifies me the expiration date for the logins. In this way I'm able to change the expiring password in advance and to comunicate it to the users.
I use a script for a centralm location which connets via telnet, remsh or rexec to teh othegrs users, collect the expiration info and produce a report. A best way to do this is to use the rexec command.
Let me know if you are intersted to it and I'll provide you.
(I'd like to avoid to post unnecessary script)
HTH,
Art

[Justin_132]

Hi Arthuro,

Yep...Grateful to you if you can share your script...

Just-In

[Arturo Galbiati]

Hi,
this is teh script.
It uses a configuration file. THsi is an example:
# Line starting with # is a comment, field separator is space
# Format: user [command] [server]
# server can be omitted, default is local server
# command can be omitted, default is remsh
# If you put server you had to put command as well
user_a rexec
user_b
user_c passwd
#EOF

The user_a has to have an entry in the .netrc file in the home directory of teh user you will use to run the script (user_c).

The user_b has to have an entry in his .rhosts file.

The user_c doens't require anything because it's the user you are running the script (so you are already connected to it).

HTH,
Art

N.B. This script doesn't required to have rrot capability