Password policy change 2

[schrim]

Hi,
We are getting ready to implement a new password policy change for our AIX users to comply with the Auditors findings. Most, if not all of our users do not have secure enough passwords and when we put the changes into /etc/security/user file, it will inadvertently lock all users out if they don’t meet the minimum requirements. We are trying to avoid this situation. Is there a way to force a password change when the users log in? This way we can get them to change their own password without getting locked out? Just a little more info; We have 60 plus servers and hundreds of users. Thanks for your help in advance. Chris

 

[khalidaaa]

I think this can be done using the pwdadm command with the -f flag set to ADMCHG!

ADMCHG 
Resets the ADMCHG attribute without changing the user's password. This forces the user to change passwords the next time a login command or an su command is given for the user. The attribute is cleared when the user specified by the User parameter resets the password.

http://publib.boulder.ibm.com/infoc...c=/com.ibm.aix.cmds/doc/aixcmds1/chpasswd.htm

In here you will have to script this for all users in all servers!

You have to cat /etc/passwd and then use awk to exclude the first colum (user names) and then using a loop, direct this to the pwdpwd command with the -f flag! i don't have a box next to me to try this unfortunately!

Regards,
Khalid

 

[columb]

Err...

Whilst Khalid is right be very careful with this and be prepared for chaos - and I mean total chaos. Hundreds of users all having to change thir passwords with new restrictive rules means your service desk will get flooded and you will be bad guy of the week.

What we did in a similar situation was
[ol]
[li]Email ALL users informing them of the new rules and that it was their responsibility to change to new passwords conforming to these new rules - we gave them a month[/li]
[li]With one week to go we used 'crack' to identify those who hadn't changed and repeated the e-mail[/li]
[li]On 'P' day we had the Service Desk and ourselves all geared up and ready to go. It was still one of those days I'd prefer to forget[/li]
[li]Regular passes of crack identify those accounts that didn't change because they're dormant or have weak passwords for some other reason. We have 100's of users across eight systems and we're now down to a handful of problems which have deeper issues.[/li]
[/ol]
More about crach here

On the internet no one knows you're a dog

Columb Healy

 

[khalidaaa]

Yes Columb is right. Involving the users in this stage is important! User awareness will reduce help desk calls!

Regards,
Khalid

 

[schrim]

Thanks guys for the info. This will help us out a lot! A STAR for each!