Discussion Locked

Password control in an NIS environment.

0 helpful
3 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Is there any way to enforce password expiration on all systems in an NIS environment? We need to have the passwords expire every 30 days and also need to ensure that the same password is not reused. According to my admin:
We must use NIS rather than NIS+ (where password aging is possible) because of the multi-vendor and sometimes legacy nature of our networked UNIX systems. That is, we must use the most universally implemented version of Network Information Services (NIS) because of the multi-vendor environment sacrificing the use of user password aging. In other words NIS is the lowest common denominator.

3 replies

by ghislain.levesque

Hi, here is some info: Sun Solaris 6/7/8

When LDAP, NIS, or NIS+ is in effect on a system, passwd changes the NIS or NIS+ database. The NIS or NIS+ password may be different from the password on the local machine. If NIS or NIS+ is running, use passwd -r to change password information on the local machine.

Passwords must be constructed to meet the following requirements:

- Each password must have PASSLENGTH characters, where PASSLENGTH is defined in /etc/default/passwd and is set to 6.Only the first eight characters are significant.

- Each password must contain at least two alphabetic characters and at least one numeric or special character. In this case, "alphabetic" refers to all upper or lower case letters.

- Each password must differ from the user's login name and any reverse or circular shift of that login name. For comparison purposes, an upper case letter and its corresponding lower case letter are equivalent.

- New passwords must differ from the old by at least three characters. For comparison purposes, an upper case letter and its corresponding lower case letter are equivalent.

If all requirements are met, by default, the passwd command will consult /etc/nsswitch.conf to determine in which repositories to perform password update. It searches the passwd and passwd_compat entries. The sources (repositories) associated with these entries will be updated. However, the password update configurations supported are limited to the following cases. Failure to comply with the configurations will prevent users from logging onto the system. The password update configurations are:

- passwd: files

- passwd: files ldap

- passwd: files nis

- passwd: files nisplus

- passwd: compat (==> filesnis)

- passwd: compat (==> files ldap)

- passwd_compat: ldap

- passwd: compat (==> files nisplus)

- passwd_compat: nisplus

Hope this answer your question...

This discussion is closed to new replies.