trusted and getprpw

[Gord Moore]

What does the -l (local) flag do? What is a local user and opposed to a non-local user? I have this output to look at:

[root]> /usr/lbin/getprpw -l mmaiden1
uid=151, bootpw=NO, audid=422, audflg=1, mintm=0, maxpwln=-1, exptm=182, lftm=-1, spwchg=Mon Feb 9 17:00:00 2004, upwchg=Sat Mar 6 18:16:32 2004, acctexp=-1, llog=-1, expwarn=-1, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Fri Jul 16 17:37:01 2004, ulogint=Fri Jul 16 17:36:47 2004, sloginy=pts/2, culogin=-1, uloginy=-1, umaxlntr=-1, alock=NO, lockout=1000000

[root] > /usr/lbin/getprpw mmaiden1
uid=151, bootpw=NO, audid=422, audflg=1, mintm=0, maxpwln=-1, exptm=182, lftm=-1, spwchg=Tue Aug 3 18:00:00 2004, upwchg=Sat Mar 6 18:16:32 2004, acctexp=-1, llog=-1, expwarn=-1, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Fri Jul 16 17:37:01 2004, ulogint=Fri Jul 16 17:36:47 2004, sloginy=pts/2, culogin=-1, uloginy=-1, umaxlntr=-1, alock=NO, lockout=0000000

There seem to be two differences: the spwchg date and the lockout flag. Is this account locked? What programs would think so (looking at the -l version), and which one would not?

We are using NIS+ so the passwords are changed on the master, another server, and this is running on HP-UX 11i.

Thanks.

[Dave Olker · Accepted solution]

Hi Gord,

I believe "local" in this case means to retrieve the information from the local /tcb database files as opposed to the NIS+ trusted table. According to the getprpw man page, some data is kept on the NIS+ master, so it would likely make sense for this data to be different when retrieved from NIS+.

Regards,

Dave

[Sridhar Bhaskarla]

Hi,

As the name indicates, the first one displayed the information about the local account. The second one is for NIS+ users. In the first case as you can see the spwchg (The last successful password change) was done on the local account on Feb 9th where as on NIS+ it was August 3. So according to your security policies, the life time has passed for the local account hence you are seeing lockout as 1000000.

Look at the man page of getprpw. If you don't find it on 11i, then you can see it at docs.hp.com
//
-l Specifies to get information from the local user.

-n Can be specified with or without domain name; i.e., -n [domain].
If -n [domain] is specified, displays data for the NIS+ user.
The domain name must be fully qualified, with a terminating
period. If domain name is not specified, the local domain will
be used.
//

-Sri

[Sundar_7]

Gord,

As noted above, -l stands for local and will direct getprpw to work on the local tcb database as opposed to NIS+ tables.

There seem to be two differences: the spwchg date and the lockout flag. Is this account locked? What programs would think so (looking at the -l version), and which
one would not?

==> The answer to the question is it depends on how your name service is configured. Look at /etc/nsswitch.conf file.

passwd: nisplus files

If your password entry in nsswitch.conf refers to nisplus, any calls to get the user/password information will be referred to nisplus first before failing back to the local files.

-- Sundar