LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 06-25-2008, 03:16 PM   #1
kaplan71
Member
 
Registered: Nov 2003
Posts: 719

Rep: Reputation: 39
Locking out a user when password expires, but allowing them to change their password


Hi there --

Is there a way to lock out users whose passwords have expired, but allow them the capability to connect and immediately change the expired password?
 
Old 06-25-2008, 06:10 PM   #2
jailbait
Guru
 
Registered: Feb 2003
Location: Blue Ridge Mountain
Distribution: Debian Wheezy, Debian Jessie
Posts: 7,592

Rep: Reputation: 188Reputation: 188
No, because in order to connect you have to have a valid password.

-------------------
Steve Stites
 
Old 06-25-2008, 06:49 PM   #3
rjlee
Senior Member
 
Registered: Jul 2004
Distribution: Ubuntu 7.04
Posts: 1,990

Rep: Reputation: 67
jailbait's answer seems slightly simplified to me.

Linux normally uses PAM (pluggable authentication modules) to authenticate users, and you can do all sorts of weird and wonderful things, including getting terminal access and prompting for updated information if the password is out of date.

The problem is that you'd need to do quite a bit of programming to make that work, unless you can find a module that implements similar functionality already.

I think it may be easier to set up a web server that could allow the user to log in and change their system login password. I'm pretty sure you could set up an Apache webpage to authenticate a session user using the linux password through PAM, even bypassing the expiry date for the website but not for normal logins. But that's just one option of many.

A good starting point for further information might be the user authentication howto: http://www.linuxdocs.org/HOWTOs/User...OWTO/x101.html
 
Old 06-27-2008, 01:11 PM   #4
legcard
Member
 
Registered: May 2007
Posts: 33

Rep: Reputation: 15
We use pam on our redhat boxes but I don't know of any "temporarily let me in" module. If there is one, I would love to try that out.

I know that the /etc/shadow file allows you to set a "warning" time in # of days in the sixth field; we use 7 days. So as Joe-user logs in, he will get the reminder 7 days out that his password will expire and allow him to change it.
Format of the /etc/shadow is:
usernameasswd:last:min:max:warn:expire:disable:reserved

If Joe-user chooses to continue to ignore this message every time he logs in, then after 7 days, he gets to go visit the sysadmin to change his password.

Last edited by legcard; 06-27-2008 at 01:14 PM.
 
Old 06-27-2008, 02:02 PM   #5
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora, Lubuntu, FreeBSD
Posts: 3,930
Blog Entries: 5

Rep: Reputation: Disabled
Quote:
Originally Posted by kaplan71
Is there a way to lock out users whose passwords have expired, but allow them the capability to connect and immediately change the expired password?
Assuming I understand your question, you could also use:

# chage -M 999 -d 1 user_here

P.S. Be sure to read the chage(1) manpages and actually understand what that does (and how it could potentially affect system password policies you have in place) before using it.

-------------------------

Edit: After re-reading your question and this thread, it seems likely that I've misunderstood.

Last edited by anomie; 06-27-2008 at 02:04 PM.
 
Old 06-27-2008, 08:12 PM   #6
rjlee
Senior Member
 
Registered: Jul 2004
Distribution: Ubuntu 7.04
Posts: 1,990

Rep: Reputation: 67
To clarify: As I understand it, you want to give users the option to change their password without a full log-in session, if their password has expired.

Looking a bit further, GDM (the Gnome Display (Login) Manager) seems to have some sort of option to allow users to change their password after it has expired, and it does indeed use PAM.

See the second post on this page: http://bugzilla.gnome.org/show_bug.cgi?id=356109

Other posts talk about PAM prompting to change the user's password if it has expired. So it's definitely possible.

Perhaps someone who understands PAM can explain how to chain things together to make this happen?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How could normal user obtain root password or change root password ckamheng Debian 18 02-18-2009 11:28 PM
samba(global security=user) useful tools for client.ex: user change password. hocheetiong Linux - Newbie 1 03-18-2008 10:20 AM
pam_cracklib not locking user after 3 bad password attempts legcard Linux - Security 3 06-25-2007 01:28 PM
Allowing user to change the password santhosh23 Linux - General 11 05-02-2007 01:36 AM
How can I change e-mail password(or linux account password) with php in website?? yusuf Programming 1 05-28-2004 10:39 AM


All times are GMT -5. The time now is 09:42 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration