Update of tcb auth files

[George Spencer_4]

On a number of our systems running HP-UX 11.11 in trusted mode, the user data stored in the files /tcb/files/auth/*/username is not being updated with information about the last login. One can change characteristics of the user, such as the policies, and these change in the files; but the u_suclog entry does not change.

Is there a way to restore or reactivate the logging of the last successful login to these files?

[Patrick Wallek]

What do you see if you query the data with the getprpw command?

# /usr/lbin/getprpw

[George Spencer_4]

The output shows the epoch times as standard dates, but these are not correct. They are a straight conversion of the epoch times seen in the user files.

e.g.
# /usr/lbin/getprpw xxxxxx
uid=110, bootpw=NO, audid=20, audflg=1, mintm=-1, maxpwln=-1, exptm=-1, lftm=-1, spwchg=Fri Nov 21 12:31:35 2008, upwchg=-1, acctexp=-1, llog=0, expwarn=-1, usrpick=DFT, syspnpw=DFT, rstrpw=DFT, nullpw=DFT, admnum=-1, syschpw=DFT, sysltpw=DFT, timeod=-1, slogint=Fri Nov 21 12:23:51 2008, ulogint=-1, sloginy=-1, culogin=-1, uloginy=-1, umaxlntr=3, alock=NO, lockout=0000000

Incidentally, Fri Nov 21 was the date that the system was converted to trusted.

[David Nixon · Accepted solution]

Check that your PAM authentication module is patched.

E.g. PHCO_35250 (11.11 libpam_unix cumulative) deals with:

"Incorrect last login information"