🚀 go-pugleaf

Soterro wrote:
> Hello,
> 
> I'm interested to know if there's a way to ask for the status of a 
> certain user account from within a script. The machine is not having the 
> trusted features enabled. My question is not related to a specific 
> version of Tru64, I would appreciate something that works since 4.0F or 
> such if possible of course.
> 
> As far as I noticed, the administrative lock puts a 'Nologin' string in 
> front of the password entry in the passwd file, so this could be a 
> hands-on solution. However I don't know where to look whether the 
> account (and its password) is expired.
> 
> Is there a command allowing to get the user's status or do I have to 
> parse myself some (which?) configuration files? dxaccounts doesnt say 
> anything about expiration, by the way (and wouldn't be a solution anyway 
> as I can't use it from a script).
> 
> Thanks a lot,
> S
If you aren't using the C2 security features, then there is no such thing as 
password expiration.  With base security, there are only 7 fields:  username, 
password, userid, groupid, description, home directory and shell.  Locking an 
account, as you've noticed, just sticks the word "Nologin" in front of the 
encrypted password.  The more sophisticated security fields that are used to 
track password changed dates, expiration, etc., are only available when you use 
the C2 security, and they are stored in a separate database.  (Exactly where 
depends on a couple of things, particularly whether or not you're using NIS.)

If you do use C2, you can get at this data using a script (if you're su), but it 
takes a little parsing with awk to do it.

Anno Domini 3-5-2004 22:30, Mike Dorn sprak aldus:
> Soterro wrote:
> 
>> Hello,
>>
>> I'm interested to know if there's a way to ask for the status of a 
>> certain user account from within a script. The machine is not having 
>> the trusted features enabled. My question is not related to a specific 
>> version of Tru64, I would appreciate something that works since 4.0F 
>> or such if possible of course.
>>
>> As far as I noticed, the administrative lock puts a 'Nologin' string 
>> in front of the password entry in the passwd file, so this could be a 
>> hands-on solution. However I don't know where to look whether the 
>> account (and its password) is expired.
>>
>> Is there a command allowing to get the user's status or do I have to 
>> parse myself some (which?) configuration files? dxaccounts doesnt say 
>> anything about expiration, by the way (and wouldn't be a solution 
>> anyway as I can't use it from a script).
>>
>> Thanks a lot,
>> S
> 
> If you aren't using the C2 security features, then there is no such 
> thing as password expiration.  With base security, there are only 7 
> fields:  username, password, userid, groupid, description, home 
> directory and shell.  Locking an account, as you've noticed, just sticks 
> the word "Nologin" in front of the encrypted password.  The more 
> sophisticated security fields that are used to track password changed 
> dates, expiration, etc., are only available when you use the C2 
> security, and they are stored in a separate database.  (Exactly where 
> depends on a couple of things, particularly whether or not you're using 
> NIS.)
> 
> If you do use C2, you can get at this data using a script (if you're 
> su), but it takes a little parsing with awk to do it.
> 
You mean of course enhanced security, which is not necassarily C2 security.

Eric de Redelijkheid wrote:
> Anno Domini 3-5-2004 22:30, Mike Dorn sprak aldus:
>> more sophisticated security fields that are used to track password 
>> changed dates, expiration, etc., are only available when you use the 
>> C2 security, and they are stored in a separate database.  (Exactly 
 >>
> You mean of course enhanced security, which is not necassarily C2 security.

Are those enhanced security modes using the same tcb files and commands 
like a trusted system?

S

Anno Domini 4-5-2004 11:21, Soterro sprak aldus:

> Eric de Redelijkheid wrote:
> 
>> Anno Domini 3-5-2004 22:30, Mike Dorn sprak aldus:
>>
>>> more sophisticated security fields that are used to track password 
>>> changed dates, expiration, etc., are only available when you use the 
>>> C2 security, and they are stored in a separate database.  (Exactly 
> 
>  >>
> 
>> You mean of course enhanced security, which is not necassarily C2 
>> security.
> 
> 
> Are those enhanced security modes using the same tcb files and commands 
> like a trusted system?
> 
> S
Read 
http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/V51B_HTML/ARH95ETE/TITLE.HTM

Appendix A: Enhanced Security
Appendix E: C2 Level Security Configuration