what's considered as "user activity"?

[Carlos Maldonado]

when asigning accounts /bin/false, how can I make the OS aware of user activity such as imap4 or pop3 thru PAM? so that accounts don't expire when the password aging time is overdue

thanks in advance

OS version is B11.11

[Steven E. Protter]

You can use sam and disable account aging on the accounts. This works for any user.

This would deal with your pop3 and imap users.

This is how I accomplish the goal on my Linux and HP-UX servers. I've gotten no complaints to date.

SEP

[Steven E. Protter]

Ooops!

I don't use sam on Linux. I use the GUI user manager.

: looking a little red faced.

SEP

[Michael Schulte zur Sur]

Hi,

cant you disable password ageing for that users? How many passwords, do you have to use, until you can reuse one? Is there a minimum time to wait for to change a password? Please explain, why user activity should defer password ageing.

greetings,

Michael

[Bill Hassell · Accepted solution]

IMAP and POP users are not 'normal' users at all. They do not login but instead connect through a socket program which performs validation. The OS is never 'aware' of any users. Programs such as login are used as a frontend to telnet and modem connections to validate and then connect a shell to the user's port. Since the users cannot login (shell = /usr/bin/false) then those user entries in /etc/passwd should have password aging turned off.

Of course, that is not a secure situation and for email users, the only solution would be to create your own password expiration tool and then use email to notify the user to use a new password.

[Carlos Maldonado]

As of why should user activity defer password aging... I think, it's more like user activity should defer user "deactivating".

I think user aging should be disabled then, because only certain users (Admin and Power Users) have access to shell

therefore another issue comes up, I just put this server in production state and now I can see that shell appears to be a requisite for logging into sftp service, on Linux I had a kernel patch to workaround this, but on HP-UX I'm clueless

is it always necessary to have a valid shell for allwing sftp sessions? if so can I use restricted shell (I haven't tried it, I know I should test before asking)

regards and thanks for your answers :)