help on /etc/security/user file

[Edward1982]

We have applied a new password policy for our organization about 3 months ago. The problem is that we are now being prompted to change the Root password. Which line needs to be added or modified in the /etc/security/user file to avoid having to change the Root password? Thanks for your help.

 

[p5wizard]

It's a flag for root's password in /etc/security/passwd you're after:

[tt]root:
password = MGURSj.F056Dj
lastupdate = 623078865
flags = NOCHECK[/tt]

You can set that flag with

[tt]pwdadm -c root # clear all root password flags
pwdadm -f NOCHECK root # set NOCHECK flag for root password[/tt]

But it IS a good idea to periodically change passwords, including root's password.

HTH,

p5wizard

 

[khalidaaa]

What p5wizard said is one way to do this but of course this will bypass any other restrictions applied by the /etc/security/user!

The best thing is to reset maxage attribute in the /etc/security/user for root to zero!

maxage
Defines the maximum age (in weeks) of a password. The password must be changed by this time. The value is a decimal integer string. The default is a value of 0, indicating no maximum age.

This will prevent the password from expiring!

Again i second p5wizard opinion into keeping this policy as it is a good idea to change the root password from time to time!

Regards,
Khalid

 

[khalidaaa]

A full description of /etc/security/user can be found here:

http://publib.boulder.ibm.com/infoc...bm.aix.files/doc/aixfiles/passwd_security.htm

It is recommended to change values inside the /etc/security/user using the chuser command as descriped here:

http://publib.boulder.ibm.com/infocenter/systems/topic/com.ibm.aix.cmds/doc/aixcmds1/chuser.htm

What you are after can be done using the following:

chuser maxage=0 root

Regards,
Khalid

 

[Edward1982]

Great guys, thanks for the help, I did not consider the passwd file. Yes, you are correct about changing the root password. We didn't want to change it as much as the users have to thiers.