reactivation of disabled accounts

[yurika]

I got a bit overzealous trying to clean up user accounts on our HPUX 11i systems. I turned on global password aging expiration using SAM. after doing so, I went back to reactivate some accounts for some users.....even some of the system accounts.

Now I am trying to disable those accounts that are supposed to be disabled, such as sys, adm, daemon, lp...etc. I have a system which I haven't done this to, and I would like to copy their /tcb/files/auth/[daemon] file over to restore the default. is this a wise move? or is there a better way to restore.

the default i believe is supposed to have no password, an * indicating that the account is disabled.

Thank you in advance.
Yurika

[Doug O'Leary]

Hey;

for user in sys adm daemon lp
do
echo ${user}
passwd -l ${user}
modprpw -e ${user}
done

HTH;

Doug

[yurika]

modprpw is not found when I try to excute it.
my system IS in trusted mode, what else could be preventing me from finding the command?

Thank you,

[Rick Garland]

If you have trusted system, all passwds are * in the /etc/passwd file.

This does not indicate that the account is disabled.

[erics_1]

/usr/lbin/modprpw

[Kent Ostby]

yudi ... check out this document . It has some good tips for troubleshooting this type of issue: KBRC00010639

[Denver Osborn · Accepted solution]

For those system accounts (daemon, bin, adm...) you could also move aside the users protected passwd file and running pwconv will recreate it. the prpw entry will now be set to an "*", pretty much where they were before you made the global change.

ex:
mv /tcb/auth/files/d/daemon /tmp
pwconv


hope this helps,
-denver

[yurika]

Thank you all for all your help!
the update secure password facility, pwconv seems to do the trick!
Yurika

[yurika]

thank you!