sam useradd- stop autogeneration of passwords

[Bernie Vande Griend]

I feel stupid asking this question, but since I can't find anything in the docs or the forum:
We recently converted our HP-UX 11.11 servers to Trusted mode. Our Operations staff creates users through sam as that is where we have the templates and postinstall items in place. It is now generating an 8 character password automatically. Is there any way to change this so that is asks the operator for a new initial password instead? (Besides writing a useradd script that we run from the command line)

[Pete Randall]

Check your template - that is where you can specify that it prompt you for the password - at least on non-trusted systems, that is.


Pete

[Andy Torres]

Generating authorization at user creation is a feature of a trusted system to ensure the user is the only person that knows their password. It probably can't be bypassed as it would compromise the secrecy of the user's password, defeating the purpose of trusting in the first place.

I'd say look through the "Setting Up Password Controls" section of "Administering Your HP-UX Trusted System" at http://docs.hp.com/en/B2355-90121/index.html and see if you spot anything I couldn't at first glance. Maybe in the policies?

[Bernie Vande Griend]

Thanks guys. I've already looked at that manual, couldn't find anything. This is trusted mode and we have looked at the templates too, we actually had to recreate the template as the old one no longer worked but we don't see anything there either.

When we set our security policy we specified that the user has to pick their password, no auto generation. But that only seems to take effect on when the password is changed, not when the account is first created.
We are working with sam generating the password now, but some of the passwords generated aren't very friendly so then we have to generate another plus the ones generated are alpha character only so it is not SOX compliant. Anyway, any other ideas on how or even if this can be changed is appreciated.

[Andy Torres]

Try this:
- Create the user in sam, allow it to generate the authorization word.
- Go back and choose to "Reset User's Password". Choose option "(p)" and set the password there. It will override the authorization word.

I tried it and it worked (as root).

[Bernie Vande Griend]

Thanks Andy. That is our workaround already. I was hoping to eliminate that extra step. So far it doesn't appear that we can.