When we convert into trusted mode, how can we exclude one account?

[morganelan]

Hi Unix Gurus,
I want to ask may be we can exclude one or more account not be audited by trusted system?Can we give special treatment to one account on trusted system such as this account we treat never expired or expired every 6 months, and the rest follow the general rules, is it possible?Please advice Gurus, thanks in advance....

[RAC_1]

You can. you can modify required setting for a user.
man modprpw and getprpw
man getprdef and modprdef

[Arunvijai_4]

I dont think it is possible to exclude an account not to be audited in a trusted system.

-Arun

[Darren Prior]

Hi Morganelan,

You can use the audusr command to exclude a number of users from being audited.

In terms of giving special treatment to one account, there is a default file that covers all users on the system for password expiry, etc. However each user also has a file within /tcb that can be used to create a separate policy for that user. This is all controlled from within SAM.

regards,

Darren.

[morganelan]

Hi Daren Prior,
How to setup this special treatment from SAM?Could you give me the example?Thanks in advance.

[Joseph Loo]

hi,

man audusr for more info.

# audusr
will show u a list of user whether audit or not.

# audusr -a
to audit the specified user

# audusr -A
audit all user

# audusr -d
do not audit specified user

# audusr -D
do not audit any user


thru SAM:
-> Auditing and Security -> Audited Users -> highlight Login Name of user(s) -> Actions -> "Audit User(s) or "Don't Audit User(s)"

regards

[morganelan]

Thanks ....