Hi all!

In order to reinforce security on some uxix boxes, i'd like to force users to change their passwd at next login.
I found out how to do it under HP-UX ( by changing their passwd field in the /etc/passwd by ",..".How can i acheive the same thing under Sun ( 2.6, and 2.8)?

Thanx

I beleive you can do this by the admintool

janr,

Thanx for your answer, but when I said some "unix boxes", I mean over 400 servers, and about 50 accounts on each server!
I'm looking for a way to do it in a shell script and put that in a batch on each server!

Any other ideas?

Hi,

This very easy , just use the command
# passwd -f <user-Name>
with -f the system wil force any login user to change his password

You can put this in a script like

#!/bin/ksh

IFS=':'

while read a b c d e f g
do
passwd -f $a

done < /tmp/passwd_file_copy

IMP: before you run this script copy the passwd file to the /tmp
with name passwd_file_copy and remove from it the users that will not change the passwd for them like root, sys ..
you can do this by the grep command

Note: I DID NOT TEST THIS SCRIPT pls. run it on one system before using it in all systems

Good luck

Eng. Wael

In fact, I'm setting up a replacement of the classic passwd command, via NPASSWD. The equivalent of the "-f" for npasswd could be "-XI".
This permits an interactive passwd only for root. I have found a way to change a password via a script, but not how to force the change

I understand your script, but I cannot see how your exemple forces users to change their password at their next login. Could you explain?

His script works because of the passwd option -f. From the man page on passwd,

Privileged User Options
Only a privileged user can use the following options:

-f Forces the user to change password at the next login
by expiring the password for name.

-l Locks password entry for name.


Of course, this works on local accounts only - will not work if you are using NIS. NIS won't allow forcing (although somehow it will under admintool).

If you are using NIS+ you can force it but I believe it's either a different command or different syntax. Not sure.

I meant to say how does the script work, and how to make it function at login?
I understand the -f option. My question concerns more the concept of the script rather than the script itself..