hi guys
I have Centos 5.4
The idea is lock the user account for 3 minutes after he has entered his password incorrectly 3 times.
I've modified /etc/pam.d/system-auth
auth required pam_tally.so onerr=fail per_user deny=3
account required pam_tally.so resetbesides... (3 Replies)
I am trying to create a shell script that will:
check if a specific user already exists
if not, create a specific group and create the user in that group
assign a password to that user, where the password is passed in as a parameter to the script
The problem that I need help with is 3 on... (4 Replies)
i created 1 user . Now its passwd time period get expired.
Now how can I set password for that user. Also how can I set a condition such a way that after every 3 months user must change his passwd. (5 Replies)
Hi all,
I'm having an issue resetting an Linux user password. As root, I type 'passwd <username>, enter the new password, but the user is still Access Denied. Can someone assist me in figuring this one out?
The box is running "Linux trm62 2.4.21-15.ELsmp #1 SMP Thu Apr 22 00:18:24 EDT 2004... (6 Replies)
hello friends,
one user is created named "user1"
I login as "user1" . Now when i do "su -" to be root user I have to give password for root .
Is there any way through which we can skip giving the password to root.
i.e.
user1@work:~$ su -
Password: xxxxxx
work:~$
I don't want that... (1 Reply)
Hi sir,
i need help in scripting..
i have 30 users like below
eda01
eda02
eda03
eda04
.....
......
eda30
I want to reset all users password start with eda01 until eda30 to default password 1234
how do i do this using script,
i dunt want system prompt me for password..
i am... (5 Replies)
I have 02 servers:
- Linux RHEL AS 3 (server1)
- AIX 5.2 (server2)
Running the command rsh server2 passwd derje from the server1 to change derje user password on server2, give me this error:
3004-709 Error while changing the password for "derje"
Can somebody help me ? (0 Replies)
passwd(1) General Commands Manual passwd(1)NAME
passwd - change user password
SYNOPSIS
passwd [-f|-g|-s|-k[-q]] [name]
passwd [-D binddn][-n min][-x max][-w warn][-i inact] account
passwd [-D binddn] {-l|-u|-d|-S[-a]|-e} name
passwd --bioapi [account]
passwd --stdin [account]
DESCRIPTION
passwd changes passwords for user and group accounts. While an administrator may change the password for any account or group, a normal
user is only allowed to change the password for their own account. passwd also changes account information, such as the full name of the
user, their login shell, password expiry dates and intervals or disable an account.
passwd is written to work through the PAM API. Essentially, it initializes itself as a "passwd" service and utilizes configured "password"
modules to authenticate and then update a user's password.
A sample /etc/pam.d/passwd file might look like this:
#%PAM-1.0
auth required pam_unix2.so nullok
account required pam_unix2.so
password required pam_pwcheck.so nullok
password required pam_unix2.so nullok
use_first_pass use_authtok
session required pam_unix2.so
Password Changes
If an old password is present, the user is first promted for it and the password is compared agaisnt the stored one. This can be changed,
depending which PAM modules are used. An administrator is permitted to bypass this step so that forgotten passwords may be changed.
After the user is authenticated, password aging information are checked to see if the user is permitted to change their password at this
time. Else passwd refuses to change the password.
The user is then prompted for a replacement password. Care must be taken to not include special control characters or characters, which
are not available on all keyboards.
If the password is accepted, passwd will prompt again and compare the second entry against the first. Both entries are require to match in
order for the password to be changed.
OPTIONS -f Change the finger (gecos) information. This are the users fullname, office room number, office phone number and home phone number.
This information is stored in the /etc/passwd file and typically printed by finger(1) and similiar programs.
-g With this option, the password for the named group will be changed.
-s This option is used to change the user login shell. A normal user may only change the login shell for their own account, the super
user may change the login shell for any account.
-k Keep non-expired authentication tokens. The password will only be changed if it is expired.
-q Try to be quiet. This option can only be used with -k.
Password expiry information
-n min With this option the minimum number of days between password changes is changed. A value of zero for this field indicates that the
user may change her password at any time. Else the user will not be permitted to change the password until min days have elapsed.
-x max With this option the maximum number of days during which a password is valid is changed. When maxdays plus lastday is less than the
current day, the user will be required to change his password before being able to use the account.
-w warn
With this option the number of days of warning before a password change is required can be changed. This option is the number of
days prior to the password expiring that a user will be warned the password is about to expire.
-i inact
This option is used to set the number of days of inactivity after a password has expired before the account is locked. A user whose
account is locked must contact the system administrator before being able to use the account again. A value of -1 disables this
feature.
Account maintenance
-l A system administrator can lock the account of the specified user.
-u A system administrator can unlock the specified account, if the account is not passwordless afterwards (it will not unlock an
account that has only "!" as a password).
-d The password of the given account can be deleted by the system administrator. If the BioAPI interface is used the BioAPI data for
that account is removed.
-S Report password status on the named account. The first part indicates if the user account is locked (LK), has no password (NP), or
has an existing or locked password (PS). The second part gives the date of the last password change. The next parts are the minimum
age, maximum age, warning period, and inactivity period for the password.
-a Report the password status for all accounts. Can only be used in conjunction with -S.
-e The user will be forced to change the password at next login.
-P path
Search passwd and shadow file in path. This option cannot be used with changing passwords.
--bioapi
This option is used to indicate that passwd should use the BioAPI for managing the authentication token of an account. It is only
supported with a small subset of other options. This option is not always available.
--stdin
This option is used to indicate that passwd should read the new password from standard input, which can be a pipe (only by a system
administrator).
Name service switch options
-D binddn
Use the Distinguished Name binddn to bind to the LDAP directory.
FILES
passwd - user account information
shadow - shadow user account information
SEE ALSO passwd(1), group(5), passwd(5), shadow(5), pam(5)AUTHOR
Thorsten Kukuk <kukuk@suse.de>
pwdutils November 2005 passwd(1)