Trusted System - any command to query the settings ?

[S.Rider]

I would like to check the
" sam - auditing & security - password format policies - User Specifies "
setting on all my systems. What's the command I can specify to display this parm ?

[A. Clay Stephenson]

cat /etc/default/security

That a portion of it.

Next you cat /tcb/files/auth/system/default

You will probably need to do a man prpwd to make sense of the last command. The system/default tcb entries define the settings unless overrideen by specific
settings in a particular user's tcb entry.
------------------------------------------
If this is SOX-related, some admins who will remain nameless have been known to simply cat those two files and present them as evidence w/o bothering to explain anything to the auditors --- who would then be forced to admit that they don't have a clue what they are looking at or choose to remain silent so the assumption is that they do know what they are loking at. Of course, I'm speaking completely hypothetically.

[Bill Hassell · Accepted solution]

As Clay stated so eloquently, the data files and settings are indeed quite cryptic. So I wrote a script to decode all of this into a readable form. If you read the script, you'll see all the gyrations needed to summarize the settings.

[Raj D.]

Rider,

/tcb/files/auth/system/default file will have the security policy settings .

Cheers,
Raj.

[Rajeev Shukla]

To see the systemwide policies you could use the following comand
/usr/lbin/getprdef -b -p -t

and to see the user specific you need to run

/usr/lbin/getprpw

[Sundar_7]

Jay,

/usr/lbin/getprdef -b will tell you the password format policies (like whether user is allowed to pick the password or the system generates etc).

This is global or system wide.

To get the individual user settings

/usr/lbin/getprpw -m usrpick,syspnpw,rstrpw,nullpw,syschpw,sysltpw root

Sundar.