System Adm » security

Removing password aging restrictions in HP-UX

Lincoln Zuljewic Silva — Wed, 27 Oct 2010 18:32:41 +0000

To remove all passwords aging restriction in HP-UX, you can use the following command:
/usr/lbin/modprpw -m llog=0,mintm=0,exptm=0,lftm=0,expwarn=0,umaxlntr=0 username

Where:
llog – Set the last login time interval (days);
mintm – Set the minimum time interval between password changes (days). 0 = none;
exptm – Set password expiration time interval (days). 0 = not expired;
lftm – Set password life time interval (days). 0 = infinite;
expwarn – Set password expiration time interval (days). 0 = not expired;
umaxlntr – Set Maximum Unsuccessful Login tries allowed. 0 = infinite.

Change user settings and password attributes in AIX

Lincoln Zuljewic Silva — Tue, 11 May 2010 14:03:53 +0000

To change some user and password settings in AIX, you should use the command "chuser". Follow some available parameters:

- loginretries -> number of login failures before lock the account.
- maxage -> maximum age of a password (in weeks)
- gecos -> general information about the user.
- groups
- home
- minlen -> minimum password length
- pgrp -> primary group

Example:
# chuser loginretries='0' maxage='0' gecos='User Foo Bar' groups='group1,group2,group3' home='/home/foobar' minlen='7' pgrp='groupX'

Unlock user account in AIX

Lincoln Zuljewic Silva — Tue, 11 May 2010 13:38:49 +0000

To unlock an user account in AIX, you should use the following command:

# chuser account_locked='false'

Lock user account in AIX

Lincoln Zuljewic Silva — Tue, 11 May 2010 13:37:33 +0000

To lock an user account in AIX, you should use the following command:

# chuser account_locked='true'

Forcing an user changing the password on AIX

Lincoln Zuljewic Silva — Mon, 30 Nov 2009 21:33:25 +0000

Forcing an user changing the password on AIX

On AIX, you can use the following commands to unlock na user and force it to change it’s password on first logon:
# pwdadm -f ADMCHG USER

Lock an user account in HP-UX

Lincoln Zuljewic Silva — Thu, 24 Sep 2009 17:45:17 +0000

To lock an user account in HP-UX, you can use the following command:

# /usr/lbin/modprpw -m alock=YES USER

rlogin access denied

Lincoln Zuljewic Silva — Mon, 15 Jun 2009 13:54:48 +0000

In some specific situations, you need use rlogin to remote access a server, but you can face the following error:

clientServer:~ # rlogin rloginServer Password: Password: Login incorrect


	login: root

	Password:

	Login incorrect
	login: root

	Password:

	Login incorrect
	login: root

	Password:

	Login incorrect

rlogin: connection closed.

If you check the /var/log/secure log on the “rloginServer”, you will find the following messages:
Jun 15 10:44:41 rloginServer rlogind[16640]: pam_securetty(rlogin:auth): access denied: tty 'rlogin' is not secure ! Jun 15 10:44:41 rloginServer rlogind[16640]: pam_rhosts_auth(rlogin:auth): denied to root@10.11.4.9 as root: access not allowed Jun 15 10:44:47 rloginServer login: pam_securetty(remote:auth): access denied: tty 'pts/0' is not secure ! Jun 15 10:44:51 rloginServer login: FAILED LOGIN 1 FROM 10.11.4.9 FOR root, Authentication failure Jun 15 10:44:53 rloginServer login: pam_securetty(remote:auth): access denied: tty 'pts/0' is not secure ! Jun 15 10:44:58 rloginServer login: FAILED LOGIN 2 FROM 10.11.4.9 FOR root, Authentication failure Jun 15 10:44:58 rloginServer login: pam_unix(remote:auth): bad username [] Jun 15 10:44:58 rloginServer login: pam_succeed_if(remote:auth): error retrieving information about user Jun 15 10:44:58 rloginServer login: FAILED LOGIN 3 FROM 10.11.4.9 FOR , User not known to the underlying authentication module Jun 15 10:44:59 rloginServer login: pam_unix(remote:auth): bad username [] Jun 15 10:44:59 rloginServer login: pam_succeed_if(remote:auth): error retrieving information about user Jun 15 10:44:59 rloginServer login: FAILED LOGIN SESSION FROM 10.11.4.9 FOR , User not known to the underlying authentication module

The problem here, is that “rlogin” is not a “secure” shell. To configure it, you should add “rlogin” (without the quotes) to /etc/securetty .

After that, you will be able to access the rlogin server.

Forcing an user changing the password on Solaris

Lincoln Zuljewic Silva — Mon, 08 Jun 2009 19:18:28 +0000

On Solaris, you can use the following commands to unlock na user and force it to change it’s password on first logon:

# passwd -f passwd: password information changed for

HP-UX password maintenance

Lincoln Zuljewic Silva — Mon, 01 Jun 2009 13:15:43 +0000

Follow a few utilities to maintain the user’s passwords:

/usr/lbin/getprpw - display protected password database information
/usr/lbin/modprpw -x – change password
/usr/lbin/modprpw -k – unlock the user

Setting session timeout on Linux

Lincoln Zuljewic Silva — Wed, 27 May 2009 12:41:14 +0000

To set an automatically shell timeout on Linux (that Will logoff that session after X seconds), you just need setup the following variable (put it in your /etc/profile):

# echo “TMOUT=300; readonly TMOUT; export TMOUT” >> /etc/profile

The “readonly” option will not allow an normal user change (ou unset) it.

Locking a Linux account

Lincoln Zuljewic Silva — Thu, 09 Apr 2009 14:11:31 +0000

Before you remove an account from a system, is a good idea lock it for one week to make sure that no one use it.

To lock, you can use the follow command:

# passwd -l username (where username is the login id).

After that, if someone try to loginusing this account, the system will return:

# su - foobar

This account is currently not available.