/usr/lbin/modprpw - dif between exptm and lftm ?

[wurzul]

I'm using /usr/lbin/modprpw to amend the trusted user DB for certain users on both 11.11. and 11.23. Does anybody know the difference between exptm (password expiry time) and lftm (password life time). The man for modprpw does'nt really help:

exptm=value

database u_exp=(value*86400).

Set password expiration time interval (days). 0 = expired. Same as non-trusted mode maximum time.

lftm=value

database u_life.

Set password life time interval (days). 0 = infinite.

Thanks

[Matti_Kurkela · Accepted solution]

The expiry time limits the maximum time between password changes. If the password is expired, the system will force the user to change it immediately when the user logs in.

If the password is left in an expired state for a long time, the system can optionally lock the account completely.

The life time causes the entire user account to expire, regardless of when or how often the password is changed.

For example, you may have a consultant working on some project. The consultant's user account can be set with a limited life time, so that the account automatically stops working after the project is over even if someone forgets to lock/remove the account after the consultant leaves. If the project requires more time than planned, the account lifetime must be explicitly extended.

MK

[Tim Nelson]

exptm is the time to expire the password and force the user to select a new one.

lftm is the amount of time since the expiration above that the account can go without changing their password. Once this time has expired and the account has not had the password changed (not accessed since) the account will become disabled.

this basically would mean that the account can exist inactive for exptm+lftm at that point the account will be marked as disabled.

e.g.

[wurzul]

Thanks for all your help.