Link to home
Create AccountLog in
Avatar of sunhux
sunhux

asked on

AIX minage & maxage & rlogin in default & indiv ids

In /etc/security/user,  we have
default:
      admin = false
      login = true
      su = false
      daemon = true
      rlogin = true
        . . .
      minage = 1
      maxage = 8
      mindiff = 3
      maxrepeats = 2
      dictionlist =
      pwdchecks =

oracle:
      minage = 0
      maxage = 0

infrauser1:
      minage = 0
      maxage = 0

sshuser:
      admin = false
      maxage = 0

infrauser2:
      minage = 0
      maxage = 0


Q1:
For infrauser1 & 2, shouldn't the minage=1 & maxage=8 to match with the default & security best practice?

Q2:
with min & maxage=0, for these 2 infra users, do these settings override the system default's minage=1 & maxage=8 ?

Q3:
For oracle account, what's the best/secure practice out there?  min & maxage=0 ?

Q4:
for sshuser used to do sftp, what's the best/secure practice out there?  min & maxage=0 ?
ASKER CERTIFIED SOLUTION
Avatar of tfewster
tfewster
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Avatar of sunhux
sunhux

ASKER

Need to clarify on what's "Yes" esp for the following 2 :

Q2:
 with min & maxage=0, for these 2 infra users, do these settings override the system default's minage=1 & maxage=8 ?
 So in the case of our infrauser1 & 2, our setting of 0 is not adhering to best practice?

 Q3:
 For oracle account, what's the best/secure practice out there?  min & maxage=0 ?
 So it should be 1 & 7 respectively according to our security policy?
Avatar of sunhux

ASKER

Miss 1 item which was in the subject of the 1st posting:

In the same /etc/security/user,
default:          
                rlogin = true  

Shouldn't rlogin be set to  'false' as rlogin doesn't require password & keys ?
SOLUTION
Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Hi sunhux - I'm happy to discuss this further if you want to.

EE prompted me to close the question and award myself points which seems a bit unethical - If you want it deleted, I have no objections!

Regards,
tfewster
No further responses from user