No "shadow" file and NOT a trusted system, HP-UX 3

[penguin1]

X-) I am experimenting with passwords and have discovered that I do not have a /etc/shadow file. I read in an Unix manual that HP-UX does not use a /etc/shadow file for passwords. In addition, I discovered that HP-UX sets up this security when you make your system a "trusted" system. Our system is not "trusted". s-) What are the ramifications (i.e., problems and headaches) I will encounter if I make the system "trusted"?

;-) What I am trying to do is setup a schedule for passwords to expire on the same day as our NT passwords expire. It appears that I have to have the system "trusted" before I can setup a time frame for expiration. Is this true?

 

[unixqueen]

Hi Penguin,

I've never implemented trusted systems, Our auditors suggested it, but from what I remember, and all I remember is that it produces masses of data in logs........however I'm sure that someone else will give you a much more experienced opinon.

I do know something about is your second question, that is you don't need trusted systems to expire passwords.
You would have to reset all the users passwords to get them in sync if that's what you wanted, but regardless, to expire the passwords when you want, add the following characters to the end of the encrypted passwd string in the password file

,xy

where x is the number of weeks that the password is valid, and y is the min number of weeks before the password can be changed

You use values like these

Value Number of weeks
. 0
/ 1
0-9 2-11
A-Z 12-37
a-z 36-63

I know that you can do password aging when setting up new accound via SAM, I'm not sure if you can modify existing users to have password aging.

Hope some of this helps

Regards
Queenie

 

[MikeLacey]

I've used trusted systems without *too* many problems. Just make sure you apply *ALL* of the recommended patches for trusted systems. Mike
michael.j.lacey@ntlworld.com
Email welcome if you're in a hurry or something -- but post in tek-tips as well please, and I will post my reply here as well.