189 lines
8.0 KiB
Groff
189 lines
8.0 KiB
Groff
.\"Generated by db2man.xsl. Don't modify this, modify the source.
|
|
.de Sh \" Subsection
|
|
.br
|
|
.if t .Sp
|
|
.ne 5
|
|
.PP
|
|
\fB\\$1\fR
|
|
.PP
|
|
..
|
|
.de Sp \" Vertical space (when we can't use .PP)
|
|
.if t .sp .5v
|
|
.if n .sp
|
|
..
|
|
.de Ip \" List item
|
|
.br
|
|
.ie \\n(.$>=3 .ne \\$3
|
|
.el .ne 3
|
|
.IP "\\$1" \\$2
|
|
..
|
|
.TH "PASSWD" 1 "" "" ""
|
|
.SH NAME
|
|
passwd \- change user password
|
|
.SH "SYNOPSIS"
|
|
.ad l
|
|
.hy 0
|
|
.HP 7
|
|
\fBpasswd\fR [\fB\-f\fR | \fB\-s\fR] [\fIname\fR]
|
|
.ad
|
|
.hy
|
|
.ad l
|
|
.hy 0
|
|
.HP 7
|
|
\fBpasswd\fR [\-g] [\fB\-r\fR | \fB\-R\fR] \fIgroup\fR
|
|
.ad
|
|
.hy
|
|
.ad l
|
|
.hy 0
|
|
.HP 7
|
|
\fBpasswd\fR [\-x\ \fImax\fR] [\-n\ \fImin\fR] [\-w\ \fIwarn\fR] [\-i\ \fIinact\fR] \fIlogin\fR
|
|
.ad
|
|
.hy
|
|
.ad l
|
|
.hy 0
|
|
.HP 7
|
|
\fBpasswd\fR [\fB\-l\fR | \fB\-u\fR | \fB\-d\fR | \fB\-S\fR | \fB\-e\fR] \fIlogin\fR
|
|
.ad
|
|
.hy
|
|
|
|
.SH "DESCRIPTION"
|
|
|
|
.PP
|
|
\fBpasswd\fR changes passwords for user and group accounts\&. A normal user may only change the password for his/her own account, the super user may change the password for any account\&. The administrator of a group may change the password for the group\&. \fBpasswd\fR also changes account information, such as the full name of the user, user's login shell, or password expiry date and interval\&.
|
|
|
|
.PP
|
|
The \fB\-s\fR option makes \fBpasswd\fR call \fBchsh\fR to change the user's shell\&. The \fB\-f\fR option makes \fBpasswd\fR call \fBchfn\fR to change the user's gecos information\&. These two options are only meant for compatibility, since the other programs can be called directly\&.
|
|
|
|
.SS "Password Changes"
|
|
|
|
.PP
|
|
The user is first prompted for his/her old password, if one is present\&. This password is then encrypted and compared against the stored password\&. The user has only one chance to enter the correct password\&. The super user is permitted to bypass this step so that forgotten passwords may be changed\&.
|
|
|
|
.PP
|
|
After the password has been entered, password aging information is checked to see if the user is permitted to change the password at this time\&. If not, \fBpasswd\fR refuses to change the password and exits\&.
|
|
|
|
.PP
|
|
The user is then prompted for a replacement password\&. This password is tested for complexity\&. As a general guideline, passwords should consist of 6 to 8 characters including one or more from each of following sets:
|
|
|
|
.TP 3
|
|
\(bu
|
|
lower case alphabetics
|
|
.TP
|
|
\(bu
|
|
digits 0 thru 9
|
|
.TP
|
|
\(bu
|
|
punctuation marks
|
|
.LP
|
|
|
|
.PP
|
|
Care must be taken not to include the system default erase or kill characters\&. \fBpasswd\fR will reject any password which is not suitably complex\&.
|
|
|
|
.PP
|
|
If the password is accepted, \fBpasswd\fR will prompt again and compare the second entry against the first\&. Both entries are required to match in order for the password to be changed\&.
|
|
|
|
.SS "Group passwords"
|
|
|
|
.PP
|
|
When the \fB\-g\fR option is used, the password for the named group is changed\&. The user must either be the super user, or a group administrator for the named group\&. The current group password is not prompted for\&. The \fB\-r\fR option is used with the \fB\-g\fR option to remove the current password from the named group\&. This allows group access to all members\&. The \fB\-R\fR option is used with the \fB\-g\fR option to restrict the named group for all users\&.
|
|
|
|
.SS "Password expiry information"
|
|
|
|
.PP
|
|
The password aging information may be changed by the super user with the \fB\-x\fR, \fB\-n\fR, \fB\-w\fR, and \fB\-i\fR options\&. The \fB\-x\fR option is used to set the maximum number of days a password remains valid\&. After \fImax\fR days, the password is required to be changed\&. The \fB\-n\fR option is used to set the minimum number of days before a password may be changed\&. The user will not be permitted to change the password until \fImin\fR days have elapsed\&. The \fB\-w\fR option is used to set the number of days of warning the user will receive before his/her password will expire\&. The warning occurs \fIwarn\fR days before the expiration, telling the user how many days remain until the password is set to expire\&. The \fB\-i\fR option is used to disable an account after the password has been expired for a number of days\&. After a user account has had an expired password for \fIinact\fR days, the user may no longer sign on to the account\&.
|
|
|
|
.PP
|
|
If you wish to immediately expire an account's password, you can use the \fB\-e\fR option\&. This in effect can force a user to change his/her password at the user's next login\&. You can also use the \fB\-d\fR option to delete a user's password (make it empty)\&. Use caution with this option since it can make an account not require a password at all to login, leaving your system open to intruders\&.
|
|
|
|
.SS "Account maintenance"
|
|
|
|
.PP
|
|
User accounts may be locked and unlocked with the \fB\-l\fR and \fB\-u\fR flags\&. The \fB\-l\fR option disables an account by changing the password to a value which matches no possible encrypted value\&. The \fB\-u\fR option re\-enables an account by changing the password back to its previous value\&.
|
|
|
|
.PP
|
|
The account status may be viewed with the \fB\-S\fR option\&. The status information consists of 7 fields\&. The first field is the user's login name\&. The second field indicates if the user account is locked (L), has no password (NP), or has a usable password (P)\&. The third field gives the date of the last password change\&. The next four fields are the minimum age, maximum age, warning period, and inactivity period for the password\&. These ages are expressed in days\&. See \fIPassword expiry information\fR above for a discussion of these fields\&.
|
|
|
|
.SS "Hints for user passwords"
|
|
|
|
.PP
|
|
The security of a password depends upon the strength of the encryption algorithm and the size of the key space\&. The \fI\\s\-2UNIX\fR System encryption method is based on the NBS DES algorithm and is very secure\&. The size of the key space depends upon the randomness of the password which is selected\&.
|
|
|
|
.PP
|
|
Compromises in password security normally result from careless password selection or handling\&. For this reason, you should not select a password which appears in a dictionary or which must be written down\&. The password should also not be a proper name, your license number, birth date, or street address\&. Any of these may be used as guesses to violate system security\&.
|
|
|
|
.PP
|
|
Your password must easily remembered so that you will not be forced to write it on a piece of paper\&. This can be accomplished by appending two small words together and separating each with a special character or digit\&. For example, Pass%word\&.
|
|
|
|
.PP
|
|
Other methods of construction involve selecting an easily remembered phrase from literature and selecting the first or last letter from each word\&. An example of this is:
|
|
|
|
.TP 3
|
|
\(bu
|
|
Ask not for whom the bell tolls
|
|
.TP
|
|
\(bu
|
|
which produces
|
|
.TP
|
|
\(bu
|
|
An4wtbt
|
|
.LP
|
|
|
|
.PP
|
|
You may be reasonably sure few crackers will have included this in their dictionaries\&. You should, however, select your own methods for constructing passwords and not rely exclusively on the methods given here\&.
|
|
|
|
.SS "Notes about group passwords"
|
|
|
|
.PP
|
|
Group passwords are an inherent security problem since more than one person is permitted to know the password\&. However, groups are a useful tool for permitting co\-operation between different users\&.
|
|
|
|
.SH "CAVEATS"
|
|
|
|
.PP
|
|
Not all options may be supported\&. Password complexity checking may vary from site to site\&. The user is urged to select a password as complex as he feels comfortable with\&. Users may not be able to change their password on a system if NIS is enabled and they are not logged into the NIS server\&.
|
|
|
|
.SH "FILES"
|
|
|
|
.TP
|
|
\fI/etc/passwd\fR
|
|
user account information
|
|
.TP
|
|
\fI/etc/shadow\fR
|
|
secure user account information
|
|
.SH "EXIT VALUES"
|
|
|
|
.PP
|
|
The \fBpasswd\fR command exits with the following values:
|
|
|
|
.TP
|
|
\fI0\fR
|
|
success
|
|
.TP
|
|
\fI1\fR
|
|
permission denied
|
|
.TP
|
|
\fI2\fR
|
|
invalid combination of options
|
|
.TP
|
|
\fI3\fR
|
|
unexpected failure, nothing done
|
|
.TP
|
|
\fI4\fR
|
|
unexpected failure, passwd file missing
|
|
.TP
|
|
\fI5\fR
|
|
passwd file busy, try again
|
|
.TP
|
|
\fI6\fR
|
|
invalid argument to option
|
|
|
|
.SH "SEE ALSO"
|
|
|
|
.PP
|
|
\fBgroup\fR(5), \fBpasswd\fR(5), \fBshadow\fR(5)
|
|
|
|
.SH "AUTHOR"
|
|
|
|
.PP
|
|
Julianne Frances Haugh <jockgrrl@ix\&.netcom\&.com>
|
|
|