Safeguard Administrator's Manual (G06.29+, H06.08+, J06.03+)

Controlling User Access
Safeguard Administrator’s Manual—523317-029
2-21
Requiring Users to Change Their Passwords
that SECURITY.SUSAN changed Bob’s authentication record on June 28, 2005. The
Safeguard software calculated a PASSWORD-EXPIRES date by adding the
PASSWORD-MUST-CHANGE period to the current date (June 28). At this point,
ADMIN.BOB has until July 28, 2005, to change his password.
Any user can use the command interpreter PASSWORD program to change his or her
own password. You can also change your password during logon without using the
PASSWORD program. This method of changing your password is described in the
Safeguard User’s Guide.
To continue the example, suppose the date is July 27, 2005, and ADMIN.BOB changes
his password with the PASSWORD command:
8> PASSWORD x87d9
After changing his password, ADMIN.BOB uses the INFO USER command to
determine the next date by which he must change his password:
9> SAFECOM INFO USER admin.bob, GENERAL
The Safeguard software has recalculated the PASSWORD-EXPIRES date. Because
ADMIN.BOB changed his password on July 27 and his PASSWORD-MUST-CHANGE
period is 30 days, his new PASSWORD-EXPIRES date is August 26.
This example illustrates the basic password expiration mechanism. When a
PASSWORD-MUST-CHANGE period is first established or changed for a user, the
Safeguard software calculates a PASSWORD-EXPIRES date by adding the
PASSWORD-MUST-CHANGE period to the current date. Also, whenever the user
changes the password, the Safeguard software calculates a new
PASSWORD-EXPIRES date by adding the PASSWORD-MUST-CHANGE period to
the current date.
The Safeguard configuration attribute PASSWORD-MAY-CHANGE can affect
password expiration and the user's ability to change the password. For a description of
the PASSWORD-MAY-CHANGE attribute, see Section 9, Configuration.
If July 28 passes and ADMIN.BOB forgets to change his password, he cannot log on to
the system after that date because he has no expired password grace period. Unable
GROUP.USER USER-ID OWNER LAST-MODIFIED LAST-LOGON STATUS WARNING-MODE
ADMIN.BOB 1,0 200,1 27JUL05, 14:09 27JUL05, 8:02 THAWED OFF
UID = 256
USER-EXPIRES = * NONE *
PASSWORD-EXPIRES = 26AUG05, 0:00
PASSWORD-MAY-CHANGE = * NONE *
PASSWORD-MUST-CHANGE EVERY = 30 DAYS
PASSWORD-EXPIRY-GRACE = * NONE *
LAST-LOGON = 27JUL05, 8:02
LAST-UNSUCESSFUL-ATTEMPT = * NONE *
LAST-MODIFIED = 27JUL05, 14:09
CREATION-TIME = 15JUN05, 02:03
FROZEN/THAWED = THAWED
STATIC FAILED LOGON COUNT = 0
STATIC-FAILED-LOGON-RESET = * NONE *
GUARDIAN DEFAULT SECURITY = OOOO
GUARDIAN DEFAULT VOLUME = $SYSTEM.NOSUBVOL