0

We're trying to deploy a tightened password policy on an AIX 5.3: Users are not allowed to reused last 24 passwords. So, I change histsize from the previous value from 5 to 24 in /etc/security/user,

default:
  histsize = 24

I test successfully with my own non-superuser account, say named support001. But it doesn't work for 2 user accounts, say named user017 and user117.

What I have tried to troubleshoot:

  1. There is no stanza for these 2 accounts in /etc/security/user
  2. run user checks, and add back 2 empty stanzas for these 2 accounts in /etc/security/user by vi

    usrck -n user017 user117

  3. run pwdck, no error is found.

    pwdck -n user017 user117

  4. check if there are double line spacing in any stanza in /etc/security/user /etc/security/passwd /etc/security/lastlog and /etc/security/group

e.g., I experienced that will cause error when reading the parms

user017:
  someparm = 1


user117:
  someparm = 1

user217:

Finally, I fallback the setting, and find that even the original value histsize = 5 is not working. Basically, users can reuse the last password just changed. Perhaps no one discovered it before.

What else should I do?

1 Answer 1

0

Try to run as root:

pwdadm -c username
password username

Login to user, check if it change password applies.

If yes, set 1st password, afterwards change it (this time as username) and try to set the same password.

If it does not work, check /etc/security/user, search for username and add histsize=2 (afterwards repeat all the steps).

You can also check it with lsuser -a histsize username

Also, make sure that the user has the following set:

lsuser -a auth1 username

Must return auth1=SYSTEM

lsuser -a registry username

Must return registry=files

If it does not work paste here the output of lsuser -f username

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .