0

We've got a customer on AIX 6.1 who unfortunately doesn't have an in house sys admin with any measure of experience or training, so we are supporting their server in addition to our software.

They have it set up in smitty (smit?), for the different users' passwords to expire every 4 weeks and have the time between expiration and lockout set to -1 (which should disable that feature).

According to the customer, when the passwords expire at the end of the 4 weeks, the accounts are locked and require their "administrator" to login as root and change the user's password. After that, the user can apparently login.

I'm a software developer, rather than a sys admin of any kind, so my knowledge of this stuff is really limited.

Anybody have any idea what is going on here? I looked at the password policies for one of the users that they say had the problem, but didn't notice anything out of the ordinary. My initial thought was that the account was expiring rather than the password, but it looks like they have password expiration setup correctly (not sure how to setup account expiration).

Any and all help/ideas and/or wild thoughts are appreciated.

3 Answers 3

1

I was beaten by a customer with a poor explanation. Turned out there were handful of users that had that flag set incorrectly, i.e. to 0 instead of -1 (which disables the lock out). Apparently to that admin, that "handful" (which she was in) was "everybody." groan

0

There are the following parameters that could be the cause: "Days to warn user before password expires" "Weeks between password expiration and lockout"

Sounds like they would want both of these set to -1, or something reasonable.

0

I am assuming "-1" refers to the 'maxexpired' attribute of a user.

"-1" does not disable that feature, rather it enforces the policy that when a password expires, the account becomes locked, and only an admin can unlock/reset the password at that point.

You can use smit or the 'chser' command to set the behavior you want. The attributes 'maxexpired' should be set to '52' if you want an password to be able to be changed by that account owner withing 52 weeks after expiration: (see http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.cmds/doc/aixcmds1/chuser.htm)

# chuser maxexpired=52 accountname

If you set 'maxexpired' to "0", then it will allow the user o change their password after it has expired for the 'maxage' set amount of weeks (in your case I am assuming 4) - so the password expires every 4 weeks, and the owner has 4 more to change the password themselves before it is locked.

# chuser maxexpired=0 accountname
1
  • I'm pretty sure you have those backwards. If you pull it up and smitty and push F1, it very clearly says that -1 disables and 0 locks out immediately.
    – Morinar
    Dec 2, 2009 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .