HP-UX Security Features - OpenMPE

Shadow Password
• De-facto standard to provide a secure local password
storage and password policy
• Allows the password field of a user entry in /etc/passwd to
be hidden from non-privileged users
− Encrypted password is replaced by ‘x’ in /etc/passwd and stored in
the root only readable file /etc/shadow
• Implements password aging policy for users stored in
local /etc/passwd file
− Defaults defined in /etc/default/security file
− Policy parameters:
• PASSWORD_MAXDAYS - maximum number of days that passwords
are valid
• PASSWORD_MINDAYS - minimum number of days before a
password can be changed
• PASSWORD_WARNDAYS - number of days before password
expiration that a user is to be warned that the password must be
changed
Authentication Services
August 26, 2004 128