Setting default password on new account creations

[generic_1]

Hello Everyone,

I have a need set the default password for new accounts created on HPUX. I have 10.20, 11, and 11i systems. There are a few untrusted system which I can not change at this.
I have a vendor tool implemented that connect and run comands as root. It does not handle for loops and such well, and I do not have any alternative tools that are implemented. PS I do not want to use expect for this at this time. Thanks for your replies in advance.

My questions are:

1. How do I convert the default password to its encrypted state that would be used in the trusted directory/files?

2. Also is this encrypted password compatible in non trusted systems for the password entry?

3. What is a simple/reliable way to source this password in the the password file and the users trusted file on trusted? Keeping in mind that loops are not very compatible with my tool. My guess is it will have to be along the lines of a sed substitution.

4. Are there any major differences in encryption of the password between ll.0 and lli that pose an issue?

[Bill Hassell · Accepted solution]

Given the variety of system revisions and the mix of Trusted and standard systems, the only simple solution is usermod.sam and a password generator program. I have attached a simple C program that will generate the 13 encrypted bytes needed for the password entry. It will compile with the K&R basic C compiler found on all HP-UX systems (I name the program pw). Although it was designed for interactive use, you can extract just the result like this:

MYPASSWD=123abc
MYCRYPT=$(pw $MYPASSWD | tail -1 | awk '{print $NF}')

MYCRYPT will have the properly encrypted password entry and works on Trusted and unTrusted. It has been in use since HP-UX version 8.xx and works fine on all the revs through 11.11.

1- Use the pw program

2- yes

3- I've tried many different sed and awk soultions. Nothing beats the simplicity of usermod.sam since this is the tool that SAM uses. Here is how you do it:

/usr/sam/lbin/usermod.sam -p $MYCRYPT user_login

usermod.sam patches the correct location in place whereas sed and awk solutions require a temp file and lots of tests to make sure the task doesn't trash everything.

4- None. The crypt call is how passwords are encrypted. There is a special consideration for Trusted systems: you are no longer limited to 8 significant characters in a password. Now since you are generating a default or standard password, this is no issue. Just make the default password = 8 characters.

As far as connecting and running commands, I use root 'helper' scripts to accomplish special tasks on the remote systems. I distribute these special commands with a batch ftp script so that all of them can be updated in less than a minute. An example is a userinfo script that runs on 10 and 11, Trusted and unTrusted and returns detailed info about the state of the user's account.

[generic_1]

Hello Bill,

That was an excellent answer Bill. You do not happen to have an example of the userinfo script?

[Gareth Tunstall]

Here is a script I wrote that lets you set a user password directly from the command line. It is set to allow up to 16 characters in the password, but there are comments on how the password encryption works and can be modified as required.

It uses /usr/lbin/makekey to perform the encryption and /usr/sam/lbin/usermod.sam -p to apply the crypted password

Gareth

[Bill Hassell]

Yep. The userinfo script is attached. You can trace it by setting the variable DEBUG as in:

DEBUG=1 userinfo billh

Fairly useful to look at disabled accounts or other details. Works on 10.xx and up, Trusted and unTrusted.

[generic_1]

Hello,
I like your idea Gareth, but I am having problems with the encrypted password it is generating. I am using the script as it is designed. The syntax I am using is:
./script username thepassword az
When I plug it in on untrusted I get an invalid sorry.

When I plug it in on trusted it accepts the password and says it is expired although getprpw is returning alock and all 0s.

Many thanks,
Jeff

[generic_1]

Hello does anyoe know why I would be running into problems with a new account being locked under trusted when I use a password from Gareth's script and a good way to deal with the encrypted password length. I have the feeling this may be causing me some problems too.

[Bill Hassell]

I've attached a newpassword creation script that works on Trusted and non-Trusted systems. It will generate a random number as the initial password, much like the auth-ID used by SAM when creating a new user. It will expire the user's new password so they must change it upon login. You can change the script to create a specified password. Note that the code is limited to 8-character password creation. See the notes at the bottom about how to null-fill a string.

[Bill Hassell]

Here's a script that set the password for a user, Trusted or unTrusted. It can also set the password aging (min_chg and maxm_life days). If min/max not specified, password aging is turned off. Password characters are limited to alphanumeric a few punctuation chars for portability, and password length is 2-8 only. To extend the password maximum will require verifying that the current system is Trusted (unTrusted cannot have passwords longer that 8) and adjusting the makekey code.

[Sridhar Bhaskarla]

Jeff,

Another idea is to use "/usr/lib/makekey" to generate the encrypted passwords for you. One caveat with this program is that the input strings has to be exactly 10 chars. First 8 chars being the actual password and the last two is "salt", arbitrary chars. This should work for your need as you are trying to setup a default password initially. If you have a password that's less than 8 chars, then substitute the rest with null characters. For ex.,

$echo "Test1234xy|/usr/lib/makekey"
xyyB13z8Nr6jw
$echo "Test12\0\0xy| /usr/lib/makekey"
xyCFvTRIXUTVA

If you want better passwords, you can write a simple program using "bigcrypt" function.

I agree with the previous postings that there isn't a better tool than /usr/sam/lbin/usermod.sam to embed the encrypted passwords into password registry.

-Sri