In the last episode (Jul 06), Mike Carlson said:
> Is there a way in 5.x to have account passwords expire every 180
> days? Or I should say N days really. I think this was once tunable in
> /etc/login.conf but thats has been repalced with PAM.
>
> Anyway, I just need account passwords to expire every 180 days, any
> help is appreciated.
It looks like pam_unix does check the passwd-change field in
master.passwd, but I don't see any code that resets the field when a
password is updated. The login.conf and passwd manpages refer to a
"passwordtime" capability, but libpam zeroes out the change field when
the passwd is changed.
Try the following patch. After rebuilding pam_unix.so, edit
/etc/login.conf, set "passwordtime" to some short value like "10m", run
"cap_mkdb /etc/login.conf", change a password, and see if it expires in
10 minutes.
Index: pam_unix.c
===
RCS file: /home/ncvs/src/lib/libpam/modules/pam_unix/pam_unix.c,v
retrieving revision 1.49
diff -u -r1.49 pam_unix.c
--- pam_unix.c 10 Feb 2004 10:13:21 - 1.49
+++ pam_unix.c 6 Jul 2005 20:14:06 -
@@ -371,8 +371,10 @@
if ((old_pwd = pw_dup(pwd)) == NULL)
return (PAM_BUF_ERR);
- pwd->pw_change = 0;
lc = login_getclass(NULL);
+ pwd->pw_change = login_getcaptime(lc, "passwordtime", 0, 0);
+ if (pwd->pw_change)
+ pwd->pw_change += time(NULL);
if (login_setcryptfmt(lc, password_hash, NULL) == NULL)
openpam_log(PAM_LOG_ERROR,
"can't set password cipher, relying on default");
--
Dan Nelson
[EMAIL PROTECTED]
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
