Date: Wed, 6 Jul 2005 15:24:10 -0500 From: Dan Nelson <dnelson@allantgroup.com> To: Mike Carlson <m87carlson@gmail.com> Cc: freebsd-questions@freebsd.org Subject: Re: Account password expiration Message-ID: <20050706202410.GB38925@dan.emsphone.com> In-Reply-To: <fe1fa63f050706122852ab1eca@mail.gmail.com> References: <fe1fa63f050706122852ab1eca@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In the last episode (Jul 06), Mike Carlson said: > Is there a way in 5.x to have account passwords expire every 180 > days? Or I should say N days really. I think this was once tunable in > /etc/login.conf but thats has been repalced with PAM. > > Anyway, I just need account passwords to expire every 180 days, any > help is appreciated. It looks like pam_unix does check the passwd-change field in master.passwd, but I don't see any code that resets the field when a password is updated. The login.conf and passwd manpages refer to a "passwordtime" capability, but libpam zeroes out the change field when the passwd is changed. Try the following patch. After rebuilding pam_unix.so, edit /etc/login.conf, set "passwordtime" to some short value like "10m", run "cap_mkdb /etc/login.conf", change a password, and see if it expires in 10 minutes. Index: pam_unix.c =================================================================== RCS file: /home/ncvs/src/lib/libpam/modules/pam_unix/pam_unix.c,v retrieving revision 1.49 diff -u -r1.49 pam_unix.c --- pam_unix.c 10 Feb 2004 10:13:21 -0000 1.49 +++ pam_unix.c 6 Jul 2005 20:14:06 -0000 @@ -371,8 +371,10 @@ if ((old_pwd = pw_dup(pwd)) == NULL) return (PAM_BUF_ERR); - pwd->pw_change = 0; lc = login_getclass(NULL); + pwd->pw_change = login_getcaptime(lc, "passwordtime", 0, 0); + if (pwd->pw_change) + pwd->pw_change += time(NULL); if (login_setcryptfmt(lc, password_hash, NULL) == NULL) openpam_log(PAM_LOG_ERROR, "can't set password cipher, relying on default"); -- Dan Nelson dnelson@allantgroup.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050706202410.GB38925>