prpwd.4 (2010 09)

p
prpwd(4) prpwd(4)
(TO BE OBSOLETED)
NAME
prpwd - protected password authentication database files used for trusted systems
SYNOPSIS
/tcb/files/auth/*
DESCRIPTION
An authentication profile is maintained for each user on the system. A user profile is kept in a protected
password database file that is accessible only to the System Administrator. The protected password data-
base files contain among other things the encrypted password for the user account. On a trusted system,
the passwords are hidden from normal users.
The protected password database files do not obviate the need for the
/etc/passwd and the
/etc/group files. Users must be defined in the
/etc/passwd file in order to use the system. The
protected password database file for a user contains the user name and user id to provide a correlation to
the user’s
/etc/passwd entry. These must match or the user account will be treated as invalid.
Protected password database files are maintained in the
/tcb/files/auth
hierarchy. This directory
contains other directories each named with a single letter from the alphabet. User authentication profiles
are stored in these directories based on the first letter of the user account name. This enables an efficient
search operation to locate the file for a specific user name. For instance, the authentication profile for the
root account is located in the /tcb/files/auth/r
directory and can be accessed by opening the file
/tcb/files/auth/r/root
.
Fields defined in a file are user specific values. These values override the system default values. Trusted
programs check first for the existence of user specific parameters before using a system default value.
A protected password database file contains keyword field identifiers and, depending on the field type, a
value for that field (certain field types do not require an explicit value). The exact syntax for field
specifications is described in authcap (4). Field specification is consistent for all system authentication
databases. The keyword field identifiers supported by the protected password database file and their
associated function are given in the following descriptions:
u_name This is the user name for the account which must match the name of the file and the
user name from the corresponding
/etc/passwd entry.
u_id This is the user ID for the account which must match the user id field of the
corresponding /etc/passwd entry.
u_pwd This field contains the encrypted password for the account if the account has a pass-
word.
u_owner This field contains the owner of the account.
u_booauth If this field exists and contains a value greater than zero (typically 1), and the boot
authenticate flag is set in the system default file, then this user has authority to boot
the system. If the boot authenticate flag is not set in the system default file then this
field is not used.
u_audid This field contains the audit ID for the user.
u_auditflag This field contains the audit flag for the user.
u_minchg This field specifies the minimum password change time in seconds. If non-zero, the
password cannot be changed until the specified number of seconds since the last suc-
cessful password change have passed unless the person changing the password is
authorized to override this constraint.
u_maxlen This field specifies the maximum length for system-generated passwords. It should be
less than the system-wide maximum value defined by the <prot.h> constant
AUTH_MAX_PASSWD_LENGTH.
u_exp This field is a time_t value that specifies when the account password will expire.
When a password expires, system authentication programs will request that the pass-
word be changed when the user logs into the system. If the password lifetime expires
before the password is changed, the account will be locked.
u_life This field is a time_t value that specifies the lifetime of a password. If this time is
reached, the account will be locked and can only be unlocked by an authorized system
administrator.
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1