Lockout Duration in AiX

Is there a way to set the lockout duration in AIX? i.e. the account is locked out and it will unlock itself in 30 minutes?

That kind of thing?

If so, how?

Thanks

Josh
JoshFinkAsked:
Who is Participating?
 
cloud5Connect With a Mentor Commented:
AIX does not provide a clean, built-in solution to this.

You'll need to script it.

Try using the attached code (or modify it to suit your needs).

It takes one parameter:  the username to check (run it in a "for" loop in another script if you want to check more usernames).  If the user's account has been locked due to invalid logins, and if the user last failed greater than 30 minutes ago, it'll reset the failed count back to zero.

Run it via root's cron once every five minutes or so.
#!/usr/bin/ksh
 
readonly MINUTES_TO_UNLOCK=30
readonly SECONDS_PER_MINUTE=60
 
if [[ $# -lt 1 ]]; then
    echo "Please specify a username to check" >&2
    exit 1
fi
 
username=$1
 
set -A userdata $(/usr/bin/lsuser -c              \
                  -a unsuccessful_login_count     \ 
                     loginretries                 \
                     time_last_unsuccessful_login ${username} | \
                  sed -e 1d -e 's/:/ /g')
curtime=$(/usr/bin/perl -e "print time")
 
unsuccessful_login_count=${userdata[1]}
loginretries=${userdata[2]}
time_last_unsuccessful_login=${userdata[3]}
 
# Account is locked due to too many unsuccessful attempts
if [[ ${unsuccessful_login_count} -gt ${loginretries} ]]; then
 
    # Calculate number of minutes since user last failed to log in.
    minutes_since_last_fail=$(((curtime - time_last_unsuccessful_login) / ${SECONDS_PER_MINUTE}))
 
    # User last logged in greater than MINUTES_TO_UNLOCK minutes ago;
    # unlock them.
    if [[ ${minutes_since_last_fail} -gt ${MINUTES_TO_UNLOCK} ]]; then
        chsec -f /etc/security/lastlog \
              -a "unsuccessful_login_count=0" \
              -s ${username}
    fi
fi

Open in new window

0
 
Kent OlsenData Warehouse Architect / DBACommented:
Hi JoshFink,

AIX doesn't have any of this capability built in, but you can build it yourself.  Mostly with your own scripts and cron jobs.

Some use of these two variables may be a good place to start:


unsuccessful_login_count in /etc/security/lastlog and
login_retries in /etc/security/user.




Good Luck,
Kent
0
 
amirs80Commented:
yes u can do it
read the file
#cd /etc/security
#vi login.cfg (or any editor u like most)

the parameter in this file help u a lot
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.