User creation templates

[mhutchins]

Is there a file I can edit that will make all users I create have default values?

On AIX 5.3.

Thanks!

 

[hfaix]

/etc/security/user is the file that the default values are specified. All new users will pull the default, unless you specify otherwise.

 

[Mag0007]

I would prefer you to make a backup of this file, and use the "chuser" command for all the changes.

 

[mhutchins]

Thanks for the help! I think I am leaning more towards setting the parmams that I want for all users in the default stanza and then if I need to I can always make changes for exceptions to the default.

Make sense?

Thanks!

 

[hfaix]

Is this a new machine? If so, go for it.

If it's not, be careful. This can be done, however, it might bight you in the rear too. You could use chuser, however, if you're making single user changes, smit user works like a champ.

just my 2 cents.

 

[mhutchins]

I see what you are saying now. I want to be able to say here are the default settings for all new users, not all users. I backed up the /etc/security/users file and then modified these settings under the default stanza:
loginretries = 3
minalpha = 1
minother = 1
minlen = 6
minage = 1
maxage = 8
maxexpired = 8
histexpire = 52
histsize = 12
pwdwarntime = 5
And of course it modified all users including root, so I had to back it out. Don't want my root accounts password expiring. I have some systems with many users and I want to all new users to get these settings without me having to go through and set them each time. Is there a way to say apply these settings but not on root or sys etc?

 

[hfaix]

You have a couple options.

Option one:
If you have time, the cleanest way to do it is, set the defaults in this user file. Next, go through "smit user", "Change / Show Characteristics of a User" and set any values for users that are not the default. This should include users like root.

Option two:
Create a new stanza for each user that differs from the default:

example :
root:
admin = true
SYSTEM = "compat"
registry = files
loginretries = 0
account_locked = false
rlogin = false

 

[RodKnowlton]

To specify the default settings for new users, edit /usr/lib/security/mkuser.default.



Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

 

[hfaix]

Rod, as always is correct. This will work as well.

 

[mhutchins]

Thanks for the tips. These were all good.