Securing Logins and Passwords (Tasks)

You can limit remote logins, require users to have passwords, and require the root account to have a complex password. You can also display a security message to users, monitor failed access attempts, and disable logins temporarily.

Securing Logins and Passwords (Task Map)

The following task map points to procedures that monitor user logins and that disable user logins.

How to Change the root Password

When you change the root password, you must comply with the password requirements that apply to all users of the system.

Before You Begin

You must assume the root role. For more information, see How to Use Your Assigned Administrative Rights.

• Change your password.

  # passwd root
  New Password:
  Re-enter new Password:
  passwd: password successfully changed for root

  A message prints to the screen if your password does not conform to requirements. The messages are informative. After three attempts, you must run the command again to change the password.

  passwd: Password too short - must be at least 6 characters.
  passwd: The password must contain at least 2 alphabetic character(s).
  passwd: The password must contain at least 1 numeric or special character(s).

How to Display a User's Login Status

Before You Begin

You must assume the root role. For more information, see How to Use Your Assigned Administrative Rights.

• Display a user's login status by using the logins command.

  # logins -x -l username

  -x

  Displays an extended set of login status information.

  -l username

  Displays the login status for the specified user. The variable username is a user's login name. Multiple login names are separated by commas.

  The logins command uses the appropriate password database to obtain a user's login status. The database can be the local /etc/passwd file, or a password database for the naming service. For more information, see the logins(1M) man page.

Example 3-1 Displaying a User's Login Status

In the following example, the login status for the user jdoe is displayed.

# logins -x -l jdoe
jdoe       500     staff           10   Jaylee Jaye Doe
                   /home/jdoe
                   /bin/bash
                   PS 010103 10 7 -1

jdoe

Identifies the user's login name.

500

Identifies the user ID (UID).

staff

Identifies the user's primary group.

10

Identifies the group ID (GID).

Jaylee Jaye Doe

Identifies the comment.

/home/jdoe

Identifies the user's home directory.

/bin/bash

Identifies the login shell.

PS 010170 10 7 -1

Specifies the password aging information:

• Last date that the password was changed

• Number of days that are required between changes

• Number of days before a change is required

• Warning period

How to Display Users Without Passwords

Before You Begin

You must assume the root role. For more information, see How to Use Your Assigned Administrative Rights.

• Display all users who have no passwords by using the logins command.

  # logins -p

  The -p option displays a list of users with no passwords. The logins command uses the passwd database from the local system unless a distributed naming service is specified in the password property of the system/name-service/switch service.

Example 3-2 Displaying Accounts Without Passwords

In the following example, the user pmorph and the role roletop do not have passwords.

# logins -p
pmorph          501     other           1       Polly Morph
roletop         211     admin           1       Role Top
# 

How to Temporarily Disable User Logins

Temporarily disable user logins during system shutdown or routine maintenance. root logins are not affected. For more information, see the nologin(4) man page.

Before You Begin

You must become an administrator who is assigned the solaris.admin.edit/etc/nologin authorization. By default, the root role has this authorization. For more information, see How to Use Your Assigned Administrative Rights.

1. Create the /etc/nologin file in a text editor.

   # pfedit /etc/nologin

   For an example of using the solaris.admin.edit/etc/nologin authorization, see Example 3-3.

2. Include a message about system availability.
3. Close and save the file.

Example 3-3 Disabling User Logins

In this example, a user is authorized to write the notification of system unavailability.

% pfedit /etc/nologin
***No logins permitted.***

***The system will be unavailable until 12 noon.***

About Failed Logins

To monitor all failed login attempts to the system, refer to the audit trail that is generated by the auditing service. For more information , see Part VII, Auditing in Oracle Solaris.