03-05-2013
One wonders why you would want the root account to never need changing. This is a security risk. You should have a regular procedure to change the root password and keep it secure. If someone managed to get your encrypted password file, then a brute force attack could eventually crack the root password and then they would have full control, including locking you out.
Robin
Liverpool/Blackburn
UK
10 More Discussions You Might Find Interesting
1. AIX
Hi,
I am into production support and handling some of the AIX servers. We are planning to have a user id on a AIX system with non-expired password. Now the question is that if I have a non expired password then I cannot do a interactive login to AIX machine ( i:e cannot do Telnet ,SSH etc)... (0 Replies)
Discussion started by: siddhhuu
0 Replies
2. UNIX for Advanced & Expert Users
Hi all,
I am using redhat linux version 9 .I am unable to login to the system and i am getting a warninig sorry root account is expired . How can i activate the account. (2 Replies)
Discussion started by: mallesh
2 Replies
3. Solaris
We have expiration set on the root password for 30 days. the only way to login as root remotley is login as another user and then su as root. I logged in to the machine today tried to su as root, and got the message
password has expired, use passwd to change
but i cant get in as root..
If... (1 Reply)
Discussion started by: csaunders
1 Replies
4. UNIX for Advanced & Expert Users
Dear friends,
I am using linux os .
my root passward has expired suddenly.
in command prompt iam giving su-
and password
it is saying that your root password has expired .
how to get my root password.
anyone pls rep.
rajan (3 Replies)
Discussion started by: rajan_ka1
3 Replies
5. UNIX for Advanced & Expert Users
Hi
When i try to login with my username/password i get the following message
'Password for user 'lmathew' has expired - use passwd(1) to update it'
please let me know what to do
Thanks in advane
Ammu (2 Replies)
Discussion started by: ammu
2 Replies
6. UNIX for Dummies Questions & Answers
Afternoon All
Has anyone seen this type of thing before. Basically we had an issue where an ID that has db2 connect access tried to make the db connection and got an " Attempt to establish connection failed with security reason "1"
("PASSWORD EXPIRED"). SQLSTATE=08001" error.
This I know... (0 Replies)
Discussion started by: philib
0 Replies
7. Solaris
Recently, the root pass expired on a Solaris box. And then, i can't log into the system anymore.....Below are two issues i met:
1. I tried to login the system via telnet and ssh. Only the ssh prompt me to set a new password. The system only told me that the pass is expired and turn it off during... (1 Reply)
Discussion started by: sleepy_11
1 Replies
8. Solaris
Hello All,
I have several solaris boxes running Solaris 8. When changing root passwords on them, all will simply ask for the new root password to change and of course to re-type the new password. One of the systems however asks for the existing root password before it will display the new password... (8 Replies)
Discussion started by: tferrazz
8 Replies
9. UNIX for Dummies Questions & Answers
Hello folks,
I have few linux machines and one server from which I can connect to others without password (of course ssh key). On some server when root password will expired is asking me for change passord but on some servers no. When I can find some configuration of this behavior?
Thx for any... (1 Reply)
Discussion started by: vikus
1 Replies
10. Solaris
Hello everybody, hope you all are having a good day.
Here is our (my) situation...
We have a process where we clone Solaris 8 hard disk drives then have to configure each drive for the system they will be used in. In the old cloning image the root password never expired. We also have... (7 Replies)
Discussion started by: Wrongway
7 Replies
LEARN ABOUT DEBIAN
pam_pwcheck
pam_pwcheck(8) Reference Manual pam_pwcheck(8)
NAME
pam_pwcheck - PAM module for password strength checking
DESCRIPTION
The pam_pwcheck is a PAM module for password strength checking. It makes additional checks upon password changes, but does not perform the
change itself. It only provides functionality for one PAM management group: password changing.
This module works in the following manner: if enabled, it first calls the Cracklib routine to check the strength of the password; if crack
likes the password, the module does an additional set of strength checks. These checks are:
Palindrome
Is the new password a palindrome of the old one?
Case Change Only
Is the new password the old one with only a change of case?
Similar
Is the new password too similar to old one?
Simple Is the new password too short?
Rotated
Is the new password a rotated version of the old password?
Already used
Was the password used in the past? Previously used passwords are to be found in /etc/security/opasswd.
OPTIONS
The following options may be passed to the module:
cracklib=<path to dictionaries>
Use cracklib library for password checks. This parameter also contains the path to the cracklib dictionaries. The default is
/usr/lib/cracklib_dict.
debug A lot of debug information is printed with syslog(3).
maxlen=number
Number of significant characters in the password for crypt(3). A value of zero suppresses this check. The default is 0.
minlen=number
The minimum number of characters in an acceptable password. A new password with fewer characters will be rejected. A value of zero
suppresses this check. The default is 5.
no_obscure_checks
No additional checks will be performed before a new password is accepted. Since the checks performed are fairly simple, their usage
is recommended.
not_set_pass
If this option is given, pam_pwcheck will not make the new password available for other modules.
nullok Normally the account is disabled if no password is set or if the length of the password is zero. With this option you can allow the
user to change his password for such accounts. This option does not overwrite a hardcoded default by the calling process.
tries=number
Maximum number of attempts to change a password if the new ones are rejected because they are too easy.
use_authtok
Set the new password to the one provided by the previously stacked password module. If this option is not set, pam_pwcheck will ask
the user for the new password.
use_first_pass
By default pam_pwcheck tries to get the authentication token from a previous module. If no token is available, the user is asked
for the old password. With this option, pam_pwcheck aborts with an error if no authentication token from a previous module is
available.
remember=XX
Remember the last XX passwords and do not allow the user to reuse any of these for the next XX password changes. XX is a number
between 1 and 400.
enforce_for_root
If this option is set, most of the password check rules are enforced for root, too. Never use this option if you don't know what
you are doing, since it could be as result that root is no longer allowed to login at all.
FILES
/etc/security/opasswd
SEE ALSO
passwd(1), pam.conf(8), pam.d(8), pam(8), rpasswd(1), rpasswdd(8), rpc.yppasswdd(8), yppasswd(1)
pam_pwcheck September 2008 pam_pwcheck(8)