trusted 11i - password aging default (enabled)

[John Kittel]

Is there a way to set user accounts to password aging default (enabled) either 1)globally for all users, or 2) individually from the command line? I have system default settings established in /etc/default/security, but many accounts are set to use custom settings, not the defaults. modprpw and passwd commands do not appear to have an option for this action.

I searched the forums, and have seen several threads with the same or similar question, and the question never seems to get answered... or perhaps I am just misunderstanding or haven't searched enough(?). I do not want to set or modify individual custom settings for an account to match what the system default settings are; I want to set the accounts to use the system defaults, so they are not using any custom settings, whether the same or different from the system defaults.

[Uday_S_Ankolekar]

When you convert a system to trusted, password aging becomes enabled by default.

-USA..

[A. Clay Stephenson · Accepted solution]

This is not too difficult. You first need to write a script that loops through all the users (presumably with UID's >= 101) and calls modprpw.

For example, to remove the u_minchg values from the user's entry:

modprpw -m mintm=-1 username

(mintm ==> u_minchg in the tcb database)

Now, edit /tcb/files/auth/system/default and set u_minchg in seconds to the desired value and it will take effect because you have removed the corresponding entry from the users' tcb entry.

You do the same thing with as many parameters as you wish. Modprpw accepts multiple changes in one comand. Man modprpw for details.

[John Kittel]

Ah! Thanks Clay. The part I was missing was that the value -1 allows the system default setting to be used.

Also, I see I misstated the location of the defaults in my original post. Of course you are correct, it is in the tcb.

- John

[John Kittel]

.