03-25-2015
Passwd -l or -u modifies lastchg field in /etc/shadow file
Hi,
I have a Solaris 10 box where password aging is not functioning properly. Using the passwd command with the -l or -u options causes the lastchg field in the /etc/shadow file to be modified. Therefore, if a user's password is set to expire in 90 days and they are 1 day away, all they have to do is lock their password and get it unlocked and they will have another 90 days using their current password.
I believe this could be a patch issue (missing one?) but I have been unable to track down a specific patch.
Any ideas/suggestions would be great.
Thanks
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hello, was looking for some help on extracting a field from the passwd file.
So far I have made a copy of the passwd file and changed my rights so I can edit it. Every user's password is coded as an :x:, and my goal was to change that x to a blank, and then try to extract any user with that field... (2 Replies)
Discussion started by: xBuRnTx
2 Replies
2. UNIX for Dummies Questions & Answers
I've encountered shadow files where the "lastchg" parameters are set to NULL and also zero (0) for some Solaris machines (one running v10, one running v8).
I was wondering what impact this has on password ageing, and therefore enforced password change.
Does the NULL mean the account has never... (0 Replies)
Discussion started by: Lampers
0 Replies
3. UNIX for Dummies Questions & Answers
Thanks
AVKlinux (11 Replies)
Discussion started by: avklinux
11 Replies
4. Solaris
i wonder if there is a tool to read the /etc/passwd or /etc/shadow files in order to reset user accounts to the same one.
By moving (restore) all filessytem and data to another same Sun box, none of the users are able to logon to the new box which i didn't change nothing. But if i reset the user... (1 Reply)
Discussion started by: lamoul
1 Replies
5. UNIX for Advanced & Expert Users
I'm trying to make this work, and it half works. Accounts with password hashes matching the old crypt(3) algorithm work just fine:
JUpfW/w6jo6aw
But accounts with longer password hashes preceded by $1$, such as the following, do not work:
$1$iIcbppdP$HDyjJeVMGgJ.ovLsnjtTR.... (0 Replies)
Discussion started by: davidstvz
0 Replies
6. Solaris
Hi Folks,
I have Solaris 10, latest release.
We have passwd aging set in /etc/defalut/passwd.
I have an account that passwd should never expire. Acheived by emptying associated users shadow file entries for passwd aging.
When I reset the users passwd using passwd command, it re enables... (3 Replies)
Discussion started by: BG_JrAdmin
3 Replies
7. Solaris
Hi , can anyone explain me the difference between /etc/shadow and /etc/default/passwd . As per my knowledge both the files are used for password aging and control parameters. (2 Replies)
Discussion started by: rogerben
2 Replies
8. Solaris
Hi experts,
Can somebody explain, what is 9th field in /etc/shadow ? The last digit - (5 Replies)
Discussion started by: solaris_1977
5 Replies
9. UNIX for Advanced & Expert Users
hi, all
I just started on new box where I have to diff passwd working perfectly on the very same account/user. I see that shadow was added recently (I'm not a root in there), I see 'x' in passwd. Not sure how it should work, should I change old passwd for one defined in shadow? Or it's fine to... (20 Replies)
Discussion started by: trento17
20 Replies
10. Solaris
Hi all..
I moved the /etc/shadow and /etc/shadow files to /tmp and then rebooted my PARC machine running 5.10. I did it to see if I could recover from single user mode.
But, I forgot to enable the abort key-sequence which I earlier disabled.
Stuck!
One of my gurus told I had to... (9 Replies)
Discussion started by: satish51392111
9 Replies
LEARN ABOUT REDHAT
shadow
SHADOW(5) File Formats Manual SHADOW(5)
NAME
shadow - encrypted password file
DESCRIPTION
shadow contains the encrypted password information for user's accounts and optional the password aging information. Included is
Login name
Encrypted password
Days since Jan 1, 1970 that password was last changed
Days before password may be changed
Days after which password must be changed
Days before password is to expire that user is warned
Days after password expires that account is disabled
Days since Jan 1, 1970 that account is disabled
A reserved field
The password field must be filled. The encryped password consists of 13 to 24 characters from the 64 character alphabet a thru z, A thru
Z, 0 thru 9, . and /. Refer to crypt(3) for details on how this string is interpreted.
The date of the last password change is given as the number of days since Jan 1, 1970. The password may not be changed again until the
proper number of days have passed, and must be changed after the maximum number of days. If the minimum number of days required is greater
than the maximum number of day allowed, this password may not be changed by the user.
An account is considered to be inactive and is disabled if the password is not changed within the specified number of days after the pass-
word expires. An account will also be disabled on the specified day regardless of other password expiration information.
This information supercedes any password or password age information present in /etc/passwd.
This file must not be readable by regular users if password security is to be maintained.
FILES
/etc/passwd - user account information
/etc/shadow - encrypted user passwords
SEE ALSO
chage(1), login(1), passwd(1), su(1), passwd(5), pwconv(8), pwunconv(8), sulogin(8)
AUTHOR
Julianne Frances Haugh (jockgrrl@ix.netcom.com)
SHADOW(5)