Setting expiry dates for users (user ids) in hpux.

[senthil_kumar_1]

Hi All,

I am using HPUX 10.20, 11.00 and 11.11, all are running in standard mode.

How to set the expiry dates for users (user ids).

[TTr]

I would like to be able to set expiry dates for *some* of my users but if you are asking about passwords, you use the passwd -f -n -w -x options with the appropriate values (in # of weeks). If you have a lot of users, you either run he passwd command in a script or do it for one user and then dupplicate the age string to the rest of the accounts.
The age string is at the end of the encrypted password string after the coma ","

username:XXXXXXXXXXXXX,1234:UID:GID:....

[senthil_kumar_1]

Hi TTr

Thanks, but i know this.

Is there any way to set the expiry dates for users not for passwords in hpux?

[TTr]

If you are talking about user accounts, and disabling them or deleting them, no there is no such feature. You have to create it yourself using one or more scripts that you run in cron. You check the last time a user loged in and if it is more than a predetermined number of days (30 days, 60 days etc) you disable or delete the account. It is not an easy thing to do and requires some involved scripting.

[senthil_kumar_1]

what is the command to disable the user account in hpux.

[TTr · Accepted solution]

There is no command, you use vipw to edit the password file and put an asterisk * in the encrypted password filed.

username:*:UID:GID:....

In addition to the asterisk you can add another meaningful word such as LOCKED etc as in

username:**LOCKED**:UID:GID:....
username:**DISABLED**:UID:GID:....

You must have at least one asterisk in the encrypted password field.

Having the hp-ux security packages and trusted systems gives you some more flexibility

[Steven E. Protter]

Shalom,

For OS users in /etc/passwd

userdel
# deletes the user

Commonly -r will be used to recursively delete that users files.

passwd -l
# locks the user immediately.

A great deal of what you know about 10.20, 11.00 and 11.11 will still work in 11.31

SEP

[mvpel]

I prefer putting date information in the lock string, such as *LK20091014* - it makes it easy for scripts, such as those for home directory archiving and removal, to parse.

[Hakki Aydin Ucar]

Senthil,

According to what you are looking for, everyone here suggested solutions, and I want to summarize what I would do if I were you:

First make a script does disable a specific user by password Lock OR userdel facility.

Then, I d put this script in cronjob so I can adjust whenever you want to run disable that user.

[Suraj K Sankari]

Hi,
>>what is the command to disable the user account in hpux

passwd -l will lock the user.

or open your /etc/passwd file in vi or vipw put a "#" hash mark infront of the user.

Suraj

[Dennis Handly]

>vipw put a "#" hash mark in front of the user.

A # isn't a comment char in /etc/passwd. You have just added a # to the user name.

[Suraj K Sankari]

Hi Dennis,
>>A # isn't a comment char in /etc/passwd. You have just added a # to the user name.

If you put a hash mark at the beginig of a line that means that user not able to login see the below example

suraj:*:108:103:Suraj Sankari SA:/home/suraj:/usr/bin/ksh

if i put like this then suraj not able to login into the server

#suraj:*:108:103:Suraj Sankari SA:/home/suraj:/usr/bin/ksh

Suraj

[Dennis Handly]

>Suraj: if I put like this then suraj not able to login into the server
#suraj:*:108:103:Suraj Sankari SA:/home/suraj:/usr/bin/ksh

(You need to remove that "*" to test. Also did you try logging on with #suraj?)

When I added a "#", I could su to it and got this:
ll xxxxxx
-rw-rw-r-- 1 #meyer 0 Oct 15 01:22 xxxxxx
$ su \#meyer
$ id
uid=26751(#meyer)