Trusted system denial of service

[Mike Duffy]

Hello,

We are running a trusted system hpux11. I would like accounts not to be permanently disabled when a user has too many unsuccessful logon attempts. I would like the account to be disabled for a increasing ammount of time as more failed attempts are made.

[Tom Geudens]

Hi Mike,
Well, you can get most of the info you'll need from underneath the /tcb directory ... but I'm afraid you'll have to write the scripts to do this yourself, for as far as I know there's no "native" way to do this in HP-UX.

However, taking a look in the SAMlog should get you on the way (and /usr/lbin/modprpw might as well ;-).

Regards,
Tom Geudens

[Jairo Campana]

configure using sam
option:
#sam
Auditing and security
Sytem Security Policy

General account Polices

[Tyler Easterling]

Hi,

I've attached a script which will detect and unlock only user accounts which have been locked due to unsuccessful login tries. You may use this script from a cron job at regular intervals, or as you see fit you can adapt a more complex mechanism for extending the amount of time a user spends locked out.

Tyler