1 '\" te 2 .\" Copyright 1989 AT&T 3 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved. 4 .\" Copyright 2015 Nexenta Systems, Inc. All rights reserved. 5 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. 6 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the 7 .\" fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner] 8 .TH PASSWD 1 "Jun 18, 2015" 9 .SH NAME 10 passwd \- change login password and password attributes 11 .SH SYNOPSIS 12 .LP 13 .nf 14 \fBpasswd\fR [\fB-r\fR files | \fB-r\fR ldap | \fB-r\fR nis | \fB-r\fR nisplus] [\fIname\fR] 15 .fi 16 17 .LP 18 .nf 19 \fBpasswd\fR [\fB-r\fR files] [\fB-egh\fR] [\fIname\fR] 20 .fi 21 22 .LP 23 .nf 24 \fBpasswd\fR [\fB-r\fR files] \fB-s\fR [\fB-a\fR] 25 .fi 26 27 .LP 28 .nf 29 \fBpasswd\fR [\fB-r\fR files] \fB-s\fR [\fIname\fR] 30 .fi 31 32 .LP 33 .nf 34 \fBpasswd\fR [\fB-r\fR files] [\fB-d\fR | \fB-l\fR | \fB-u\fR | \fB-N\fR] [\fB-f\fR] [\fB-n\fR \fImin\fR] 35 [\fB-w\fR \fIwarn\fR] [\fB-x\fR \fImax\fR] \fIname\fR 36 .fi 37 38 .LP 39 .nf 40 \fBpasswd\fR \fB-r\fR ldap [\fB-egh\fR] [\fIname\fR] 41 .fi 42 43 .LP 44 .nf 45 \fBpasswd\fR [\fB-r\fR ldap ] \fB-s\fR [\fB-a\fR] 46 .fi 47 48 .LP 49 .nf 50 \fBpasswd\fR [\fB-r\fR ldap ] \fB-s\fR [\fIname\fR] 51 .fi 52 53 .LP 54 .nf 55 \fBpasswd\fR \fB-r\fR ldap [\fB-d | -l | -u | -N\fR] [\fB-f\fR] [\fB-n\fR \fImin\fR] [\fB-w\fR \fIwarn\fR] [\fB-x\fR \fImax\fR] \fIname\fR 56 .fi 57 58 .LP 59 .nf 60 \fBpasswd\fR \fB-r\fR nis [\fB-egh\fR] [\fIname\fR] 61 .fi 62 63 .LP 64 .nf 65 \fBpasswd\fR \fB-r\fR nisplus [\fB-egh\fR] [\fB-D\fR \fIdomainname\fR] [\fIname\fR] 66 .fi 67 68 .LP 69 .nf 70 \fBpasswd\fR \fB-r\fR nisplus \fB-s\fR [\fB-a\fR] 71 .fi 72 73 .LP 74 .nf 75 \fBpasswd\fR \fB-r\fR nisplus [\fB-D\fR \fIdomainname\fR] \fB-s\fR [\fIname\fR] 76 .fi 77 78 .LP 79 .nf 80 \fBpasswd\fR \fB-r\fR nisplus [\fB-l\fR | \fB-u\fR | \fB-N\fR] [\fB-f\fR] [\fB-n\fR \fImin\fR] [\fB-w\fR \fIwarn\fR] 81 [\fB-x\fR \fImax\fR] [\fB-D\fR \fIdomainname\fR] \fIname\fR 82 .fi 83 84 .LP 85 .nf 86 \fBpasswd\fR \fB-S\fR [\fIname\fR] 87 .fi 88 89 .SH DESCRIPTION 90 .LP 91 The \fBpasswd\fR command changes the password or lists password attributes 92 associated with the user's login \fIname\fR. Additionally, privileged users can 93 use \fBpasswd\fR to install or change passwords and attributes associated with 94 any login \fIname\fR. 95 .sp 96 .LP 97 When used to change a password, \fBpasswd\fR prompts everyone for their old 98 password, if any. It then prompts for the new password twice. When the old 99 password is entered, \fBpasswd\fR checks to see if it has aged sufficiently. If 100 \fBaging\fR is insufficient, \fBpasswd\fR terminates; see \fBpwconv\fR(1M), 101 \fBnistbladm\fR(1), and \fBshadow\fR(4) for additional information. 102 .sp 103 .LP 104 The \fBpwconv\fR command creates and updates \fB/etc/shadow\fR with information 105 from \fB/etc/passwd\fR. \fBpwconv\fR relies on a special value of \fBx\fR in 106 the password field of \fB/etc/passwd\fR. This value of \fBx\fRindicates that 107 the password for the user is already in \fB/etc/shadow\fR and should not be 108 modified. 109 .sp 110 .LP 111 If aging is sufficient, a check is made to ensure that the new password meets 112 construction requirements. When the new password is entered a second time, the 113 two copies of the new password are compared. If the two copies are not 114 identical, the cycle of prompting for the new password is repeated for, at 115 most, two more times. 116 .sp 117 .LP 118 Passwords must be constructed to meet the following requirements: 119 .RS +4 120 .TP 121 .ie t \(bu 122 .el o 123 Each password must have \fBPASSLENGTH\fR characters, where \fBPASSLENGTH\fR is 124 defined in \fB/etc/default/passwd\fR and is set to \fB6\fR. Setting 125 \fBPASSLENGTH\fR to more than eight characters requires configuring 126 \fBpolicy.conf\fR(4) with an algorithm that supports greater than eight 127 characters. 128 .RE 129 .RS +4 130 .TP 131 .ie t \(bu 132 .el o 133 Each password must meet the configured complexity constraints specified in 134 \fB/etc/default/passwd\fR. 135 .RE 136 .RS +4 137 .TP 138 .ie t \(bu 139 .el o 140 Each password must not be a member of the configured dictionary as specified in 141 \fB/etc/default/passwd\fR. 142 .RE 143 .RS +4 144 .TP 145 .ie t \(bu 146 .el o 147 For accounts in name services which support password history checking, if prior 148 password history is defined, new passwords must not be contained in the prior 149 password history. 150 .RE 151 .sp 152 .LP 153 If all requirements are met, by default, the \fBpasswd\fR command consults 154 \fB/etc/nsswitch.conf\fR to determine in which repositories to perform password 155 update. It searches the \fBpasswd\fR and \fBpasswd_compat\fR entries. The 156 sources (repositories) associated with these entries are updated. However, the 157 password update configurations supported are limited to the following cases. 158 Failure to comply with the configurations prevents users from logging onto the 159 system. The password update configurations are: 160 .RS +4 161 .TP 162 .ie t \(bu 163 .el o 164 \fBpasswd: files\fR 165 .RE 166 .RS +4 167 .TP 168 .ie t \(bu 169 .el o 170 \fBpasswd: files ldap\fR 171 .RE 172 .RS +4 173 .TP 174 .ie t \(bu 175 .el o 176 \fBpasswd: files nis\fR 177 .RE 178 .RS +4 179 .TP 180 .ie t \(bu 181 .el o 182 \fBpasswd: files nisplus\fR 183 .RE 184 .RS +4 185 .TP 186 .ie t \(bu 187 .el o 188 \fBpasswd: compat\fR (==> files nis) 189 .RE 190 .RS +4 191 .TP 192 .ie t \(bu 193 .el o 194 \fBpasswd: compat\fR (==> files ldap) 195 .sp 196 \fBpasswd_compat: ldap\fR 197 .RE 198 .RS +4 199 .TP 200 .ie t \(bu 201 .el o 202 \fBpasswd: compat\fR (==> files nisplus) 203 .sp 204 \fBpasswd_compat: nisplus\fR 205 .RE 206 .sp 207 .LP 208 You can add the \fBad\fR keyword to any of the \fBpasswd\fR configurations in 209 the above list. However, you cannot use the \fBpasswd\fR command to change the 210 password of an Active Directory (AD) user. If the \fBad\fR keyword is found in 211 the \fBpasswd\fR entry during a password update operation, it is ignored. To 212 update the password of an AD user, use the \fBkpasswd\fR(1) command. 213 .sp 214 .LP 215 Network administrators, who own the NIS+ password table, can change any 216 password attributes. The administrator configured for updating LDAP shadow 217 information can also change any password attributes. See \fBldapclient\fR(1M). 218 .sp 219 .LP 220 When a user has a password stored in one of the name services as well as a 221 local \fBfiles\fR entry, the \fBpasswd\fR command updates both. It is possible 222 to have different passwords in the name service and local files entry. Use 223 \fBpasswd\fR \fB-r\fR to change a specific password repository. 224 .sp 225 .LP 226 In the \fBfiles\fR case, super-users (for instance, real and effective uid 227 equal to \fB0\fR, see \fBid\fR(1M) and \fBsu\fR(1M)) can change any password. 228 Hence, \fBpasswd\fR does not prompt privileged users for the old password. 229 Privileged users are not forced to comply with password aging and password 230 construction requirements. A privileged user can create a null password by 231 entering a carriage return in response to the prompt for a new password. (This 232 differs from \fBpasswd\fR \fB-d\fR because the \fBpassword\fR prompt is still 233 displayed.) If NIS is in effect, superuser on the root master can change any 234 password without being prompted for the old NIS \fBpasswd\fR, and is not forced 235 to comply with password construction requirements. 236 .sp 237 .LP 238 If LDAP is in effect, superuser on any Native LDAP client system can change any 239 password without being prompted for the old LDAP passwd, and is not forced to 240 comply with password construction requirements. 241 .sp 242 .LP 243 Normally, \fBpasswd\fR entered with no arguments changes the password of the 244 current user. When a user logs in and then invokes \fBsu\fR(1M) to become 245 superuser or another user, \fBpasswd\fR changes the original user's password, 246 not the password of the superuser or the new user. 247 .sp 248 .LP 249 Any user can use the \fB-s\fR option to show password attributes for his or her 250 own login \fIname\fR, provided they are using the \fB-r\fR \fBnisplus\fR 251 argument. Otherwise, the \fB-s\fR argument is restricted to the superuser. 252 .sp 253 .LP 254 The format of the display is: 255 .sp 256 .in +2 257 .nf 258 \fIname status mm/dd/yy min max warn\fR 259 .fi 260 .in -2 261 .sp 262 263 .sp 264 .LP 265 or, if password aging information is not present, 266 .sp 267 .in +2 268 .nf 269 \fIname status\fR 270 .fi 271 .in -2 272 .sp 273 274 .sp 275 .LP 276 where 277 .sp 278 .ne 2 279 .na 280 \fB\fIname\fR\fR 281 .ad 282 .RS 12n 283 The login \fBID\fR of the user. 284 .RE 285 286 .sp 287 .ne 2 288 .na 289 \fB\fIstatus\fR\fR 290 .ad 291 .RS 12n 292 The password status of \fIname\fR. 293 .sp 294 The \fIstatus\fR field can take the following values: 295 .sp 296 .ne 2 297 .na 298 \fBLK\fR 299 .ad 300 .RS 6n 301 This account is \fBlocked\fR account. See Security. 302 .RE 303 304 .sp 305 .ne 2 306 .na 307 \fBNL\fR 308 .ad 309 .RS 6n 310 This account is a \fBno login\fR account. See \fBSecurity\fR. 311 .RE 312 313 .sp 314 .ne 2 315 .na 316 \fBNP\fR 317 .ad 318 .RS 6n 319 This account has no password and is therefore open without authentication. 320 .RE 321 322 .sp 323 .ne 2 324 .na 325 \fBPS\fR 326 .ad 327 .RS 6n 328 This account has a password. 329 .RE 330 331 .RE 332 333 .sp 334 .ne 2 335 .na 336 \fB\fImm/dd/yy\fR\fR 337 .ad 338 .RS 12n 339 The date password was last changed for \fIname\fR. All password aging dates are 340 determined using Greenwich Mean Time (Universal Time) and therefore can differ 341 by as much as a day in other time zones. 342 .RE 343 344 .sp 345 .ne 2 346 .na 347 \fB\fImin\fR\fR 348 .ad 349 .RS 12n 350 The minimum number of days required between password changes for \fIname\fR. 351 \fBMINWEEKS\fR is found in \fB/etc/default/passwd\fR and is set to \fBNULL\fR. 352 .RE 353 354 .sp 355 .ne 2 356 .na 357 \fB\fImax\fR\fR 358 .ad 359 .RS 12n 360 The maximum number of days the password is valid for \fIname\fR. \fBMAXWEEKS\fR 361 is found in \fB/etc/default/passwd\fR and is set to \fBNULL\fR. 362 .RE 363 364 .sp 365 .ne 2 366 .na 367 \fB\fIwarn\fR\fR 368 .ad 369 .RS 12n 370 The number of days relative to \fImax\fR before the password expires and the 371 \fIname\fR are warned. 372 .RE 373 374 .SS "Security" 375 .LP 376 \fBpasswd\fR uses \fBpam\fR(3PAM) for password change. It calls PAM with a 377 service name \fBpasswd\fR and uses service module type \fBauth\fR for 378 authentication and password for password change. 379 .sp 380 .LP 381 Locking an account (\fB-l\fR option) does not allow its use for password based 382 login or delayed execution (such as \fBat\fR(1), \fBbatch\fR(1), or 383 \fBcron\fR(1M)). The \fB-N\fR option can be used to disallow password based 384 login, while continuing to allow delayed execution. 385 .SH OPTIONS 386 .LP 387 The following options are supported: 388 .sp 389 .ne 2 390 .na 391 \fB\fB-a\fR\fR 392 .ad 393 .RS 17n 394 Shows password attributes for all entries. Use only with the \fB-s\fR option. 395 \fIname\fR must not be provided. For the \fBnisplus\fR repository, this shows 396 only the entries in the NIS+ password table in the local domain that the 397 invoker is authorized to read. For the \fBfiles\fR and \fBldap\fR repositories, 398 this is restricted to the superuser. 399 .RE 400 401 .sp 402 .ne 2 403 .na 404 \fB\fB-D\fR \fIdomainname\fR\fR 405 .ad 406 .RS 17n 407 Consults the \fBpasswd.org_dir\fR table in \fBdomainname\fR. If this option is 408 not specified, the default \fBdomainname\fR returned by 409 \fBnis_local_directory\fR(3NSL) are used. This domain name is the same as that 410 returned by \fBdomainname\fR(1M). 411 .RE 412 413 .sp 414 .ne 2 415 .na 416 \fB\fB-e\fR\fR 417 .ad 418 .RS 17n 419 Changes the login shell. The choice of shell is limited by the requirements 420 of \fBgetusershell\fR(3C). If the user currently has a shell that is not 421 allowed by \fBgetusershell\fR, only root can change it. 422 .RE 423 424 .sp 425 .ne 2 426 .na 427 \fB\fB-g\fR\fR 428 .ad 429 .RS 17n 430 Changes the gecos (finger) information. For the \fBfiles\fR repository, this 431 only works for the superuser. Normal users can change the \fBldap\fR, 432 \fBnis\fR, or \fBnisplus\fR repositories. 433 .RE 434 435 .sp 436 .ne 2 437 .na 438 \fB\fB-h\fR\fR 439 .ad 440 .RS 17n 441 Changes the home directory. 442 .RE 443 444 .sp 445 .ne 2 446 .na 447 \fB\fB-r\fR\fR 448 .ad 449 .RS 17n 450 Specifies the repository to which an operation is applied. The supported 451 repositories are \fBfiles\fR, \fBldap\fR, \fBnis\fR, or \fBnisplus\fR. 452 .RE 453 454 .sp 455 .ne 2 456 .na 457 \fB\fB-s\fR \fIname\fR\fR 458 .ad 459 .RS 17n 460 Shows password attributes for the login \fIname\fR. For the \fBnisplus\fR 461 repository, this works for everyone. However for the \fBfiles\fR and \fBldap\fR 462 repositories, this only works for the superuser. It does not work at all for 463 the \fBnis\fR repository which does not support password aging. 464 .sp 465 The output of this option, and only this option is Stable and parsable. The 466 format is \fIusername\fR followed by white space followed by one of the 467 following codes. 468 .sp 469 New codes might be added in the future so code that parses this must be 470 flexible in the face of unknown codes. While all existing codes are two 471 characters in length that might not always be the case. 472 .sp 473 The following are the current status codes: 474 .sp 475 .ne 2 476 .na 477 \fB\fBLK\fR\fR 478 .ad 479 .RS 6n 480 Account is locked for UNIX authentication. \fBpasswd -l\fR was run or the 481 authentication failed \fBRETRIES\fR times. 482 .RE 483 484 .sp 485 .ne 2 486 .na 487 \fB\fBNL\fR\fR 488 .ad 489 .RS 6n 490 The account is a no login account. \fBpasswd -N\fR has been run. 491 .RE 492 493 .sp 494 .ne 2 495 .na 496 \fB\fBNP\fR\fR 497 .ad 498 .RS 6n 499 Account has no password. \fBpasswd -d\fR was run. 500 .RE 501 502 .sp 503 .ne 2 504 .na 505 \fB\fBPS\fR\fR 506 .ad 507 .RS 6n 508 The account probably has a valid password. 509 .RE 510 511 .sp 512 .ne 2 513 .na 514 \fB\fBUN\fR\fR 515 .ad 516 .RS 6n 517 The data in the password field is unknown. It is not a recognizable hashed 518 password or any of the above entries. See \fBcrypt\fR(3C) for valid password 519 hashes. 520 .RE 521 522 .RE 523 524 .SS "Privileged User Options" 525 .LP 526 Only a privileged user can use the following options: 527 .sp 528 .ne 2 529 .na 530 \fB\fB-d\fR\fR 531 .ad 532 .RS 11n 533 Deletes password for \fIname\fR and unlocks the account. The login \fIname\fR 534 is not prompted for password. It is only applicable to the \fBfiles\fR and 535 \fBldap\fR repositories. 536 .sp 537 If the \fBlogin\fR(1) option \fBPASSREQ=YES\fR is configured, the account is 538 not able to login. \fBPASSREQ=YES\fR is the delivered default. 539 .RE 540 541 .sp 542 .ne 2 543 .na 544 \fB\fB-f\fR\fR 545 .ad 546 .RS 11n 547 Forces the user to change password at the next login by expiring the password 548 for \fIname\fR. 549 .RE 550 551 .sp 552 .ne 2 553 .na 554 \fB\fB-l\fR\fR 555 .ad 556 .RS 11n 557 Locks password entry for \fIname\fR. See the \fB-d\fR or \fB-u\fR option for 558 unlocking the account. 559 .RE 560 561 .sp 562 .ne 2 563 .na 564 \fB\fB-N\fR\fR 565 .ad 566 .RS 11n 567 Makes the password entry for name a value that cannot be used for login, but 568 does not lock the account. See the \fB-d\fR option for removing the value, or 569 to set a password to allow logins. 570 .RE 571 572 .sp 573 .ne 2 574 .na 575 \fB\fB-n\fR \fImin\fR\fR 576 .ad 577 .RS 11n 578 Sets minimum field for \fIname\fR. The \fImin\fR field contains the minimum 579 number of days between password changes for \fIname\fR. If \fImin\fR is greater 580 than \fImax\fR, the user can not change the password. Always use this option 581 with the \fB-x\fR option, unless \fImax\fR is set to \fB\(mi1\fR (aging turned 582 off). In that case, \fImin\fR need not be set. 583 .RE 584 585 .sp 586 .ne 2 587 .na 588 \fB\fB-u\fR\fR 589 .ad 590 .RS 11n 591 Unlocks a locked password for entry name. See the \fB-d\fR option for removing 592 the locked password, or to set a password to allow logins. 593 .RE 594 595 .sp 596 .ne 2 597 .na 598 \fB\fB-w\fR \fIwarn\fR\fR 599 .ad 600 .RS 11n 601 Sets warn field for \fIname\fR. The \fIwarn\fR field contains the number of 602 days before the password expires and the user is warned. This option is not 603 valid if password aging is disabled. 604 .RE 605 606 .sp 607 .ne 2 608 .na 609 \fB\fB-x\fR \fImax\fR\fR 610 .ad 611 .RS 11n 612 Sets maximum field for \fIname\fR. The \fImax\fR field contains the number of 613 days that the password is valid for \fIname\fR. The aging for \fIname\fR is 614 turned off immediately if \fImax\fR is set to \fB\(mi1\fR\&. 615 .RE 616 617 .sp 618 .ne 2 619 .na 620 \fB\fB-S\fR\fR 621 .ad 622 .RS 11n 623 Read the password from standard input (pipe). 624 .RE 625 626 .SH OPERANDS 627 .LP 628 The following operand is supported: 629 .sp 630 .ne 2 631 .na 632 \fB\fIname\fR\fR 633 .ad 634 .RS 8n 635 User login name. 636 .RE 637 638 .SH ENVIRONMENT VARIABLES 639 .LP 640 If any of the \fBLC_*\fR variables, that is, \fBLC_CTYPE\fR, \fBLC_MESSAGES\fR, 641 \fBLC_TIME\fR, \fBLC_COLLATE\fR, \fBLC_NUMERIC\fR, and \fBLC_MONETARY\fR (see 642 \fBenviron\fR(5)), are not set in the environment, the operational behavior of 643 \fBpasswd\fR for each corresponding locale category is determined by the value 644 of the \fBLANG\fR environment variable. If \fBLC_ALL\fR is set, its contents 645 are used to override both the \fBLANG\fR and the other \fBLC_*\fR variables. If 646 none of the above variables is set in the environment, the \fBC\fR (U.S. style) 647 locale determines how \fBpasswd\fR behaves. 648 .sp 649 .ne 2 650 .na 651 \fB\fBLC_CTYPE\fR\fR 652 .ad 653 .RS 15n 654 Determines how \fBpasswd\fR handles characters. When \fBLC_CTYPE\fR is set to a 655 valid value, \fBpasswd\fR can display and handle text and filenames containing 656 valid characters for that locale. \fBpasswd\fR can display and handle Extended 657 Unix Code (\fBEUC\fR) characters where any individual character can be 1, 2, or 658 3 bytes wide. \fBpasswd\fR can also handle \fBEUC\fR characters of 1, 2, or 659 more column widths. In the \fBC\fR locale, only characters from ISO 8859-1 are 660 valid. 661 .RE 662 663 .sp 664 .ne 2 665 .na 666 \fB\fBLC_MESSAGES\fR\fR 667 .ad 668 .RS 15n 669 Determines how diagnostic and informative messages are presented. This includes 670 the language and style of the messages, and the correct form of affirmative and 671 negative responses. In the \fBC\fR locale, the messages are presented in the 672 default form found in the program itself (in most cases, U.S. English). 673 .RE 674 675 .SH EXIT STATUS 676 .LP 677 The \fBpasswd\fR command exits with one of the following values: 678 .sp 679 .ne 2 680 .na 681 \fB\fB0\fR\fR 682 .ad 683 .RS 6n 684 Success. 685 .RE 686 687 .sp 688 .ne 2 689 .na 690 \fB\fB1\fR\fR 691 .ad 692 .RS 6n 693 Permission denied. 694 .RE 695 696 .sp 697 .ne 2 698 .na 699 \fB\fB2\fR\fR 700 .ad 701 .RS 6n 702 Invalid combination of options. 703 .RE 704 705 .sp 706 .ne 2 707 .na 708 \fB\fB3\fR\fR 709 .ad 710 .RS 6n 711 Unexpected failure. Password file unchanged. 712 .RE 713 714 .sp 715 .ne 2 716 .na 717 \fB\fB4\fR\fR 718 .ad 719 .RS 6n 720 Unexpected failure. Password file(s) missing. 721 .RE 722 723 .sp 724 .ne 2 725 .na 726 \fB\fB5\fR\fR 727 .ad 728 .RS 6n 729 Password file(s) busy. Try again later. 730 .RE 731 732 .sp 733 .ne 2 734 .na 735 \fB\fB6\fR\fR 736 .ad 737 .RS 6n 738 Invalid argument to option. 739 .RE 740 741 .sp 742 .ne 2 743 .na 744 \fB\fB7\fR\fR 745 .ad 746 .RS 6n 747 Aging option is disabled. 748 .RE 749 750 .sp 751 .ne 2 752 .na 753 \fB\fB8\fR\fR 754 .ad 755 .RS 6n 756 No memory. 757 .RE 758 759 .sp 760 .ne 2 761 .na 762 \fB\fB9\fR\fR 763 .ad 764 .RS 6n 765 System error. 766 .RE 767 768 .sp 769 .ne 2 770 .na 771 \fB\fB10\fR\fR 772 .ad 773 .RS 6n 774 Account expired. 775 .RE 776 777 .SH FILES 778 .ne 2 779 .na 780 \fB\fB/etc/default/passwd\fR\fR 781 .ad 782 .RS 23n 783 Default values can be set for the following flags in \fB/etc/default/passwd\fR. 784 For example: \fBMAXWEEKS=26\fR 785 .sp 786 .ne 2 787 .na 788 \fB\fBDICTIONDBDIR\fR\fR 789 .ad 790 .RS 16n 791 The directory where the generated dictionary databases reside. Defaults to 792 \fB/var/passwd\fR. 793 .sp 794 If neither \fBDICTIONLIST\fR nor \fBDICTIONDBDIR\fR is specified, the system 795 does not perform a dictionary check. 796 .RE 797 798 .sp 799 .ne 2 800 .na 801 \fB\fBDICTIONLIST\fR\fR 802 .ad 803 .RS 16n 804 DICTIONLIST can contain list of comma separated dictionary files such as 805 \fBDICTIONLIST=\fR\fIfile1\fR, \fIfile2\fR, \fIfile3\fR. Each dictionary file 806 contains multiple lines and each line consists of a word and a NEWLINE 807 character (similar to \fB/usr/share/lib/dict/words\fR.) You must specify full 808 pathnames. The words from these files are merged into a database that is used 809 to determine whether a password is based on a dictionary word. 810 .sp 811 If neither \fBDICTIONLIST\fR nor \fBDICTIONDBDIR\fR is specified, the system 812 does not perform a dictionary check. 813 .sp 814 To pre-build the dictionary database, see \fBmkpwdict\fR(1M). 815 .RE 816 817 .sp 818 .ne 2 819 .na 820 \fB\fBHISTORY\fR\fR 821 .ad 822 .RS 16n 823 Maximum number of prior password history to keep for a user. Setting the 824 \fBHISTORY\fR value to zero (\fB0\fR), or removing the flag, causes the prior 825 password history of all users to be discarded at the next password change by 826 any user. The default is not to define the \fBHISTORY\fR flag. The maximum 827 value is \fB26.\fR Currently, this functionality is enforced only for user 828 accounts defined in the \fBfiles\fR name service (local 829 \fBpasswd\fR(4)/\fBshadow\fR(4)). 830 .RE 831 832 .sp 833 .ne 2 834 .na 835 \fB\fBMAXREPEATS\fR\fR 836 .ad 837 .RS 16n 838 Maximum number of allowable consecutive repeating characters. If 839 \fBMAXREPEATS\fR is not set or is zero (\fB0\fR), the default is no checks 840 .RE 841 842 .sp 843 .ne 2 844 .na 845 \fB\fBMAXWEEKS\fR\fR 846 .ad 847 .RS 16n 848 Maximum time period that password is valid. 849 .RE 850 851 .sp 852 .ne 2 853 .na 854 \fB\fBMINALPHA\fR\fR 855 .ad 856 .RS 16n 857 Minimum number of alpha character required. If \fBMINALPHA\fR is not set, the 858 default is \fB2\fR. 859 .RE 860 861 .sp 862 .ne 2 863 .na 864 \fB\fBMINDIFF\fR\fR 865 .ad 866 .RS 16n 867 Minimum differences required between an old and a new password. If 868 \fBMINDIFF\fR is not set, the default is \fB3\fR. 869 .RE 870 871 .sp 872 .ne 2 873 .na 874 \fB\fBMINDIGIT\fR\fR 875 .ad 876 .RS 16n 877 Minimum number of digits required. If \fBMINDIGIT\fR is not set or is set to 878 zero (\fB0\fR), the default is no checks. You cannot be specify \fBMINDIGIT\fR 879 if \fBMINNONALPHA\fR is also specified. 880 .RE 881 882 .sp 883 .ne 2 884 .na 885 \fB\fBMINLOWER\fR\fR 886 .ad 887 .RS 16n 888 Minimum number of lower case letters required. If not set or zero (0), the 889 default is no checks. 890 .RE 891 892 .sp 893 .ne 2 894 .na 895 \fB\fBMINNONALPHA\fR\fR 896 .ad 897 .RS 16n 898 Minimum number of non-alpha (including numeric and special) required. If 899 \fBMINNONALPHA\fR is not set, the default is \fB1\fR. You cannot specify 900 \fBMINNONALPHA\fR if \fBMINDIGIT\fR or \fBMINSPECIAL\fR is also specified. 901 .RE 902 903 .sp 904 .ne 2 905 .na 906 \fB\fBMINWEEKS\fR\fR 907 .ad 908 .RS 16n 909 Minimum time period before the password can be changed. 910 .RE 911 912 .sp 913 .ne 2 914 .na 915 \fB\fBMINSPECIAL\fR\fR 916 .ad 917 .RS 16n 918 Minimum number of special (non-alpha and non-digit) characters required. If 919 \fBMINSPECIAL\fR is not set or is zero (\fB0\fR), the default is no checks. You 920 cannot specify \fBMINSPECIAL\fR if you also specify \fBMINNONALPHA\fR. 921 .RE 922 923 .sp 924 .ne 2 925 .na 926 \fB\fBMINUPPER\fR\fR 927 .ad 928 .RS 16n 929 Minimum number of upper case letters required. If \fBMINUPPER\fR is not set or 930 is zero (\fB0\fR), the default is no checks. 931 .RE 932 933 .sp 934 .ne 2 935 .na 936 \fB\fBNAMECHECK\fR\fR 937 .ad 938 .RS 16n 939 Enable/disable checking or the login name. The default is to do login name 940 checking. A case insensitive value of \fBno\fR disables this feature. 941 .RE 942 943 .sp 944 .ne 2 945 .na 946 \fB\fBPASSLENGTH\fR\fR 947 .ad 948 .RS 16n 949 Minimum length of password, in characters. 950 .RE 951 952 .sp 953 .ne 2 954 .na 955 \fB\fBWARNWEEKS\fR\fR 956 .ad 957 .RS 16n 958 Time period until warning of date of password's ensuing expiration. 959 .RE 960 961 .sp 962 .ne 2 963 .na 964 \fB\fBWHITESPACE\fR\fR 965 .ad 966 .RS 16n 967 Determine if white space characters are allowed in passwords. Valid values are 968 \fBYES\fR and \fBNO\fR. If \fBWHITESPACE\fR is not set or is set to \fBYES\fR, 969 white space characters are allowed. 970 .RE 971 972 .RE 973 974 .sp 975 .ne 2 976 .na 977 \fB\fB/etc/oshadow\fR\fR 978 .ad 979 .RS 23n 980 Temporary file used by \fBpasswd\fR, \fBpassmgmt\fR and \fBpwconv\fR to update 981 the real shadow file. 982 .RE 983 984 .sp 985 .ne 2 986 .na 987 \fB\fB/etc/passwd\fR\fR 988 .ad 989 .RS 23n 990 Password file. 991 .RE 992 993 .sp 994 .ne 2 995 .na 996 \fB\fB/etc/shadow\fR\fR 997 .ad 998 .RS 23n 999 Shadow password file. 1000 .RE 1001 1002 .sp 1003 .ne 2 1004 .na 1005 \fB\fB/etc/shells\fR\fR 1006 .ad 1007 .RS 23n 1008 Shell database. 1009 .RE 1010 1011 .SH ATTRIBUTES 1012 .LP 1013 See \fBattributes\fR(5) for descriptions of the following attributes: 1014 .sp 1015 1016 .sp 1017 .TS 1018 box; 1019 c | c 1020 l | l . 1021 ATTRIBUTE TYPE ATTRIBUTE VALUE 1022 _ 1023 CSI Enabled 1024 _ 1025 Interface Stability See below. 1026 .TE 1027 1028 .sp 1029 .LP 1030 The human readable output is Uncommitted. The options are Committed. 1031 .SH SEE ALSO 1032 .LP 1033 \fBat\fR(1), \fBbatch\fR(1), \fBfinger\fR(1), \fBkpasswd\fR(1), \fBlogin\fR(1), 1034 \fBnistbladm\fR(1), \fBcron\fR(1M), \fBdomainname\fR(1M), \fBeeprom\fR(1M), 1035 \fBid\fR(1M), \fBldapclient\fR(1M), \fBmkpwdict\fR(1M), \fBpassmgmt\fR(1M), 1036 \fBpwconv\fR(1M), \fBsu\fR(1M), \fBuseradd\fR(1M), \fBuserdel\fR(1M), 1037 \fBusermod\fR(1M), \fBcrypt\fR(3C), \fBgetpwnam\fR(3C), \fBgetspnam\fR(3C), 1038 \fBgetusershell\fR(3C), \fBnis_local_directory\fR(3NSL), \fBpam\fR(3PAM), 1039 \fBloginlog\fR(4), \fBnsswitch.conf\fR(4), \fBpam.conf\fR(4), \fBpasswd\fR(4), 1040 \fBpolicy.conf\fR(4), \fBshadow\fR(4), \fBshells\fR(4), \fBattributes\fR(5), 1041 \fBenviron\fR(5), \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5), 1042 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_ldap\fR(5), 1043 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), \fBpam_unix_session\fR(5) 1044 .SH NOTES 1045 .LP 1046 The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is 1047 provided by \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), 1048 \fBpam_unix_session\fR(5), \fBpam_authtok_check\fR(5), 1049 \fBpam_authtok_get\fR(5), \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), and 1050 \fBpam_passwd_auth\fR(5). 1051 .LP 1052 The \fBnispasswd\fR and \fBypasswd\fR commands are wrappers around 1053 \fBpasswd\fR. Use of \fBnispasswd\fR and \fBypasswd\fR is discouraged. Use 1054 \fBpasswd\fR \fB-r\fR \fIrepository_name\fR instead. 1055 .sp 1056 .LP 1057 NIS+ might not be supported in future releases of the Solaris operating system. 1058 Tools to aid the migration from NIS+ to LDAP are available in the current 1059 Solaris release. For more information, visit 1060 http://www.sun.com/directory/nisplus/transition.html. 1061 .sp 1062 .LP 1063 Changing a password in the \fBfiles\fR and \fBldap\fR repositories clears the 1064 failed login count. 1065 .sp 1066 .LP 1067 Changing a password reactivates an account deactivated for inactivity for the 1068 length of the inactivity period. 1069 .sp 1070 .LP 1071 If \fB/etc/shells\fR is present, and is corrupted, it may provide an attack 1072 vector that would compromise the system. The \fBgetusershell\fR(3c) library 1073 call has a pre-vetted list of shells, so /etc/shells should be used with 1074 caution. 1075 .sp 1076 .LP 1077 Input terminal processing might interpret some key sequences and not pass them 1078 to the \fBpasswd\fR command. 1079 .sp 1080 .LP 1081 An account with no password, status code \fBNP\fR, might not be able to login. 1082 See the \fBlogin\fR(1) \fBPASSREQ\fR option.