| blob | 9b1580590ccd1ee68bbe930ab29fa2cd301c8994 |
1 '\" te
2 .\" Copyright 1989 AT&T
3 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
5 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
6 .\" fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH PASSWD 1 "Feb 25, 2017"
8 .SH NAME
9 passwd \- change login password and password attributes
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fBpasswd\fR [\fB-r\fR files | \fB-r\fR ldap | \fB-r\fR nis] [\fIname\fR]
14 .fi
16 .LP
17 .nf
18 \fBpasswd\fR [\fB-r\fR files] [\fB-egh\fR] [\fIname\fR]
19 .fi
21 .LP
22 .nf
23 \fBpasswd\fR [\fB-r\fR files] \fB-s\fR [\fB-a\fR]
24 .fi
26 .LP
27 .nf
28 \fBpasswd\fR [\fB-r\fR files] \fB-s\fR [\fIname\fR]
29 .fi
31 .LP
32 .nf
33 \fBpasswd\fR [\fB-r\fR files] [\fB-d\fR | \fB-l\fR | \fB-u\fR | \fB-N\fR] [\fB-f\fR] [\fB-n\fR \fImin\fR]
34 [\fB-w\fR \fIwarn\fR] [\fB-x\fR \fImax\fR] \fIname\fR
35 .fi
37 .LP
38 .nf
39 \fBpasswd\fR \fB-r\fR ldap [\fB-egh\fR] [\fIname\fR]
40 .fi
42 .LP
43 .nf
44 \fBpasswd\fR [\fB-r\fR ldap ] \fB-s\fR [\fB-a\fR]
45 .fi
47 .LP
48 .nf
49 \fBpasswd\fR [\fB-r\fR ldap ] \fB-s\fR [\fIname\fR]
50 .fi
52 .LP
53 .nf
54 \fBpasswd\fR \fB-r\fR ldap [\fB-d | -l | -u | -N\fR] [\fB-f\fR] [\fB-n\fR \fImin\fR] [\fB-w\fR \fIwarn\fR] [\fB-x\fR \fImax\fR] \fIname\fR
55 .fi
57 .LP
58 .nf
59 \fBpasswd\fR \fB-r\fR nis [\fB-egh\fR] [\fIname\fR]
60 .fi
62 .SH DESCRIPTION
63 .LP
64 The \fBpasswd\fR command changes the password or lists password attributes
65 associated with the user's login \fIname\fR. Additionally, privileged users can
66 use \fBpasswd\fR to install or change passwords and attributes associated with
67 any login \fIname\fR.
68 .sp
69 .LP
70 When used to change a password, \fBpasswd\fR prompts everyone for their old
71 password, if any. It then prompts for the new password twice. When the old
72 password is entered, \fBpasswd\fR checks to see if it has aged sufficiently. If
73 \fBaging\fR is insufficient, \fBpasswd\fR terminates; see \fBshadow\fR(4) for
74 additional information.
75 .sp
76 .LP
77 If aging is sufficient, a check is made to ensure that the new password meets
78 construction requirements. When the new password is entered a second time, the
79 two copies of the new password are compared. If the two copies are not
80 identical, the cycle of prompting for the new password is repeated for, at
81 most, two more times.
82 .sp
83 .LP
84 Passwords must be constructed to meet the following requirements:
85 .RS +4
86 .TP
87 .ie t \(bu
88 .el o
89 Each password must have \fBPASSLENGTH\fR characters, where \fBPASSLENGTH\fR is
90 defined in \fB/etc/default/passwd\fR and is set to \fB6\fR. Setting
91 \fBPASSLENGTH\fR to more than eight characters requires configuring
92 \fBpolicy.conf\fR(4) with an algorithm that supports greater than eight
93 characters.
94 .RE
95 .RS +4
96 .TP
97 .ie t \(bu
98 .el o
99 Each password must meet the configured complexity constraints specified in
100 \fB/etc/default/passwd\fR.
101 .RE
102 .RS +4
103 .TP
104 .ie t \(bu
105 .el o
106 Each password must not be a member of the configured dictionary as specified in
107 \fB/etc/default/passwd\fR.
108 .RE
109 .RS +4
110 .TP
111 .ie t \(bu
112 .el o
113 For accounts in name services which support password history checking, if prior
114 password history is defined, new passwords must not be contained in the prior
115 password history.
116 .RE
117 .sp
118 .LP
119 If all requirements are met, by default, the \fBpasswd\fR command consults
120 \fB/etc/nsswitch.conf\fR to determine in which repositories to perform password
121 update. It searches the \fBpasswd\fR and \fBpasswd_compat\fR entries. The
122 sources (repositories) associated with these entries are updated. However, the
123 password update configurations supported are limited to the following cases.
124 Failure to comply with the configurations prevents users from logging onto the
125 system. The password update configurations are:
126 .RS +4
127 .TP
128 .ie t \(bu
129 .el o
130 \fBpasswd: files\fR
131 .RE
132 .RS +4
133 .TP
134 .ie t \(bu
135 .el o
136 \fBpasswd: files ldap\fR
137 .RE
138 .RS +4
139 .TP
140 .ie t \(bu
141 .el o
142 \fBpasswd: files nis\fR
143 .RE
144 .sp
145 .LP
146 You can add the \fBad\fR keyword to any of the \fBpasswd\fR configurations in
147 the above list. However, you cannot use the \fBpasswd\fR command to change the
148 password of an Active Directory (AD) user. If the \fBad\fR keyword is found in
149 the \fBpasswd\fR entry during a password update operation, it is ignored. To
150 update the password of an AD user, use the \fBkpasswd\fR(1) command.
151 .sp
152 .LP
153 The administrator configured for updating LDAP shadow
154 information can change any password attributes. See \fBldapclient\fR(8).
155 .sp
156 .LP
157 When a user has a password stored in one of the name services as well as a
158 local \fBfiles\fR entry, the \fBpasswd\fR command updates both. It is possible
159 to have different passwords in the name service and local files entry. Use
160 \fBpasswd\fR \fB-r\fR to change a specific password repository.
161 .sp
162 .LP
163 In the \fBfiles\fR case, super-users (for instance, real and effective uid
164 equal to \fB0\fR, see \fBid\fR(8) and \fBsu\fR(8)) can change any password.
165 Hence, \fBpasswd\fR does not prompt privileged users for the old password.
166 Privileged users are not forced to comply with password aging and password
167 construction requirements. A privileged user can create a null password by
168 entering a carriage return in response to the prompt for a new password. (This
169 differs from \fBpasswd\fR \fB-d\fR because the \fBpassword\fR prompt is still
170 displayed.) If NIS is in effect, superuser on the root master can change any
171 password without being prompted for the old NIS \fBpasswd\fR, and is not forced
172 to comply with password construction requirements.
173 .sp
174 .LP
175 If LDAP is in effect, superuser on any Native LDAP client system can change any
176 password without being prompted for the old LDAP passwd, and is not forced to
177 comply with password construction requirements.
178 .sp
179 .LP
180 Normally, \fBpasswd\fR entered with no arguments changes the password of the
181 current user. When a user logs in and then invokes \fBsu\fR(8) to become
182 superuser or another user, \fBpasswd\fR changes the original user's password,
183 not the password of the superuser or the new user.
184 .sp
185 .LP
186 Any user can use the \fB-s\fR option to show password attributes for his or her
187 own login \fIname\fR. Otherwise, the \fB-s\fR argument is restricted to the
188 superuser.
189 .sp
190 .LP
191 The format of the display is:
192 .sp
193 .in +2
194 .nf
195 \fIname status mm/dd/yy min max warn\fR
196 .fi
197 .in -2
198 .sp
200 .sp
201 .LP
202 or, if password aging information is not present,
203 .sp
204 .in +2
205 .nf
206 \fIname status\fR
207 .fi
208 .in -2
209 .sp
211 .sp
212 .LP
213 where
214 .sp
215 .ne 2
216 .na
217 \fB\fIname\fR\fR
218 .ad
219 .RS 12n
220 The login \fBID\fR of the user.
221 .RE
223 .sp
224 .ne 2
225 .na
226 \fB\fIstatus\fR\fR
227 .ad
228 .RS 12n
229 The password status of \fIname\fR.
230 .sp
231 The \fIstatus\fR field can take the following values:
232 .sp
233 .ne 2
234 .na
235 \fBLK\fR
236 .ad
237 .RS 6n
238 This account is \fBlocked\fR account. See Security.
239 .RE
241 .sp
242 .ne 2
243 .na
244 \fBNL\fR
245 .ad
246 .RS 6n
247 This account is a \fBno login\fR account. See \fBSecurity\fR.
248 .RE
250 .sp
251 .ne 2
252 .na
253 \fBNP\fR
254 .ad
255 .RS 6n
256 This account has no password and is therefore open without authentication.
257 .RE
259 .sp
260 .ne 2
261 .na
262 \fBPS\fR
263 .ad
264 .RS 6n
265 This account has a password.
266 .RE
268 .RE
270 .sp
271 .ne 2
272 .na
273 \fB\fImm/dd/yy\fR\fR
274 .ad
275 .RS 12n
276 The date password was last changed for \fIname\fR. All password aging dates are
277 determined using Greenwich Mean Time (Universal Time) and therefore can differ
278 by as much as a day in other time zones.
279 .RE
281 .sp
282 .ne 2
283 .na
284 \fB\fImin\fR\fR
285 .ad
286 .RS 12n
287 The minimum number of days required between password changes for \fIname\fR.
288 \fBMINWEEKS\fR is found in \fB/etc/default/passwd\fR and is set to \fBNULL\fR.
289 .RE
291 .sp
292 .ne 2
293 .na
294 \fB\fImax\fR\fR
295 .ad
296 .RS 12n
297 The maximum number of days the password is valid for \fIname\fR. \fBMAXWEEKS\fR
298 is found in \fB/etc/default/passwd\fR and is set to \fBNULL\fR.
299 .RE
301 .sp
302 .ne 2
303 .na
304 \fB\fIwarn\fR\fR
305 .ad
306 .RS 12n
307 The number of days relative to \fImax\fR before the password expires and the
308 \fIname\fR are warned.
309 .RE
311 .SS "Security"
312 .LP
313 \fBpasswd\fR uses \fBpam\fR(3PAM) for password change. It calls PAM with a
314 service name \fBpasswd\fR and uses service module type \fBauth\fR for
315 authentication and password for password change.
316 .sp
317 .LP
318 Locking an account (\fB-l\fR option) does not allow its use for password based
319 login or delayed execution (such as \fBat\fR(1), \fBbatch\fR(1), or
320 \fBcron\fR(8)). The \fB-N\fR option can be used to disallow password based
321 login, while continuing to allow delayed execution.
322 .SH OPTIONS
323 .LP
324 The following options are supported:
325 .sp
326 .ne 2
327 .na
328 \fB\fB-a\fR\fR
329 .ad
330 .RS 17n
331 Shows password attributes for all entries. Use only with the \fB-s\fR option.
332 \fIname\fR must not be provided. For the \fBfiles\fR and \fBldap\fR
333 repositories, this is restricted to the superuser.
334 .RE
336 .sp
337 .ne 2
338 .na
339 \fB\fB-e\fR\fR
340 .ad
341 .RS 17n
342 Changes the login shell. The choice of shell is limited by the requirements
343 of \fBgetusershell\fR(3C). If the user currently has a shell that is not
344 allowed by \fBgetusershell\fR, only root can change it.
345 .RE
347 .sp
348 .ne 2
349 .na
350 \fB\fB-g\fR\fR
351 .ad
352 .RS 17n
353 Changes the gecos (finger) information. For the \fBfiles\fR repository, this
354 only works for the superuser. Normal users can change the \fBldap\fR or
355 \fBnis\fR repositories.
356 .RE
358 .sp
359 .ne 2
360 .na
361 \fB\fB-h\fR\fR
362 .ad
363 .RS 17n
364 Changes the home directory.
365 .RE
367 .sp
368 .ne 2
369 .na
370 \fB\fB-r\fR\fR
371 .ad
372 .RS 17n
373 Specifies the repository to which an operation is applied. The supported
374 repositories are \fBfiles\fR, \fBldap\fR, or \fBnis\fR.
375 .RE
377 .sp
378 .ne 2
379 .na
380 \fB\fB-s\fR \fIname\fR\fR
381 .ad
382 .RS 17n
383 Shows password attributes for the login \fIname\fR. For the \fBfiles\fR and
384 \fBldap\fR repositories, this only works for the superuser. It does not work
385 at all for the \fBnis\fR repository which does not support password aging.
386 .sp
387 The output of this option, and only this option is Stable and parsable. The
388 format is \fIusername\fR followed by white space followed by one of the
389 following codes.
390 .sp
391 New codes might be added in the future so code that parses this must be
392 flexible in the face of unknown codes. While all existing codes are two
393 characters in length that might not always be the case.
394 .sp
395 The following are the current status codes:
396 .sp
397 .ne 2
398 .na
399 \fB\fBLK\fR\fR
400 .ad
401 .RS 6n
402 Account is locked for UNIX authentication. \fBpasswd -l\fR was run or the
403 authentication failed \fBRETRIES\fR times.
404 .RE
406 .sp
407 .ne 2
408 .na
409 \fB\fBNL\fR\fR
410 .ad
411 .RS 6n
412 The account is a no login account. \fBpasswd -N\fR has been run.
413 .RE
415 .sp
416 .ne 2
417 .na
418 \fB\fBNP\fR\fR
419 .ad
420 .RS 6n
421 Account has no password. \fBpasswd -d\fR was run.
422 .RE
424 .sp
425 .ne 2
426 .na
427 \fB\fBPS\fR\fR
428 .ad
429 .RS 6n
430 The account probably has a valid password.
431 .RE
433 .sp
434 .ne 2
435 .na
436 \fB\fBUN\fR\fR
437 .ad
438 .RS 6n
439 The data in the password field is unknown. It is not a recognizable hashed
440 password or any of the above entries. See \fBcrypt\fR(3C) for valid password
441 hashes.
442 .RE
444 .RE
446 .SS "Privileged User Options"
447 .LP
448 Only a privileged user can use the following options:
449 .sp
450 .ne 2
451 .na
452 \fB\fB-d\fR\fR
453 .ad
454 .RS 11n
455 Deletes password for \fIname\fR and unlocks the account. The login \fIname\fR
456 is not prompted for password. It is only applicable to the \fBfiles\fR and
457 \fBldap\fR repositories.
458 .sp
459 If the \fBlogin\fR(1) option \fBPASSREQ=YES\fR is configured, the account is
460 not able to login. \fBPASSREQ=YES\fR is the delivered default.
461 .RE
463 .sp
464 .ne 2
465 .na
466 \fB\fB-f\fR\fR
467 .ad
468 .RS 11n
469 Forces the user to change password at the next login by expiring the password
470 for \fIname\fR.
471 .RE
473 .sp
474 .ne 2
475 .na
476 \fB\fB-l\fR\fR
477 .ad
478 .RS 11n
479 Locks password entry for \fIname\fR. See the \fB-d\fR or \fB-u\fR option for
480 unlocking the account.
481 .RE
483 .sp
484 .ne 2
485 .na
486 \fB\fB-N\fR\fR
487 .ad
488 .RS 11n
489 Makes the password entry for name a value that cannot be used for login, but
490 does not lock the account. See the \fB-d\fR option for removing the value, or
491 to set a password to allow logins.
492 .RE
494 .sp
495 .ne 2
496 .na
497 \fB\fB-n\fR \fImin\fR\fR
498 .ad
499 .RS 11n
500 Sets minimum field for \fIname\fR. The \fImin\fR field contains the minimum
501 number of days between password changes for \fIname\fR. If \fImin\fR is greater
502 than \fImax\fR, the user can not change the password. Always use this option
503 with the \fB-x\fR option, unless \fImax\fR is set to \fB\(mi1\fR (aging turned
504 off). In that case, \fImin\fR need not be set.
505 .RE
507 .sp
508 .ne 2
509 .na
510 \fB\fB-u\fR\fR
511 .ad
512 .RS 11n
513 Unlocks a locked password for entry name. See the \fB-d\fR option for removing
514 the locked password, or to set a password to allow logins.
515 .RE
517 .sp
518 .ne 2
519 .na
520 \fB\fB-w\fR \fIwarn\fR\fR
521 .ad
522 .RS 11n
523 Sets warn field for \fIname\fR. The \fIwarn\fR field contains the number of
524 days before the password expires and the user is warned. This option is not
525 valid if password aging is disabled.
526 .RE
528 .sp
529 .ne 2
530 .na
531 \fB\fB-x\fR \fImax\fR\fR
532 .ad
533 .RS 11n
534 Sets maximum field for \fIname\fR. The \fImax\fR field contains the number of
535 days that the password is valid for \fIname\fR. The aging for \fIname\fR is
536 turned off immediately if \fImax\fR is set to \fB\(mi1\fR\&.
537 .RE
539 .SH OPERANDS
540 .LP
541 The following operand is supported:
542 .sp
543 .ne 2
544 .na
545 \fB\fIname\fR\fR
546 .ad
547 .RS 8n
548 User login name.
549 .RE
551 .SH ENVIRONMENT VARIABLES
552 .LP
553 If any of the \fBLC_*\fR variables, that is, \fBLC_CTYPE\fR, \fBLC_MESSAGES\fR,
554 \fBLC_TIME\fR, \fBLC_COLLATE\fR, \fBLC_NUMERIC\fR, and \fBLC_MONETARY\fR (see
555 \fBenviron\fR(5)), are not set in the environment, the operational behavior of
556 \fBpasswd\fR for each corresponding locale category is determined by the value
557 of the \fBLANG\fR environment variable. If \fBLC_ALL\fR is set, its contents
558 are used to override both the \fBLANG\fR and the other \fBLC_*\fR variables. If
559 none of the above variables is set in the environment, the \fBC\fR (U.S. style)
560 locale determines how \fBpasswd\fR behaves.
561 .sp
562 .ne 2
563 .na
564 \fB\fBLC_CTYPE\fR\fR
565 .ad
566 .RS 15n
567 Determines how \fBpasswd\fR handles characters. When \fBLC_CTYPE\fR is set to a
568 valid value, \fBpasswd\fR can display and handle text and filenames containing
569 valid characters for that locale. \fBpasswd\fR can display and handle Extended
570 Unix Code (\fBEUC\fR) characters where any individual character can be 1, 2, or
571 3 bytes wide. \fBpasswd\fR can also handle \fBEUC\fR characters of 1, 2, or
572 more column widths. In the \fBC\fR locale, only characters from ISO 8859-1 are
573 valid.
574 .RE
576 .sp
577 .ne 2
578 .na
579 \fB\fBLC_MESSAGES\fR\fR
580 .ad
581 .RS 15n
582 Determines how diagnostic and informative messages are presented. This includes
583 the language and style of the messages, and the correct form of affirmative and
584 negative responses. In the \fBC\fR locale, the messages are presented in the
585 default form found in the program itself (in most cases, U.S. English).
586 .RE
588 .SH EXIT STATUS
589 .LP
590 The \fBpasswd\fR command exits with one of the following values:
591 .sp
592 .ne 2
593 .na
594 \fB\fB0\fR\fR
595 .ad
596 .RS 6n
597 Success.
598 .RE
600 .sp
601 .ne 2
602 .na
603 \fB\fB1\fR\fR
604 .ad
605 .RS 6n
606 Permission denied.
607 .RE
609 .sp
610 .ne 2
611 .na
612 \fB\fB2\fR\fR
613 .ad
614 .RS 6n
615 Invalid combination of options.
616 .RE
618 .sp
619 .ne 2
620 .na
621 \fB\fB3\fR\fR
622 .ad
623 .RS 6n
624 Unexpected failure. Password file unchanged.
625 .RE
627 .sp
628 .ne 2
629 .na
630 \fB\fB4\fR\fR
631 .ad
632 .RS 6n
633 Unexpected failure. Password file(s) missing.
634 .RE
636 .sp
637 .ne 2
638 .na
639 \fB\fB5\fR\fR
640 .ad
641 .RS 6n
642 Password file(s) busy. Try again later.
643 .RE
645 .sp
646 .ne 2
647 .na
648 \fB\fB6\fR\fR
649 .ad
650 .RS 6n
651 Invalid argument to option.
652 .RE
654 .sp
655 .ne 2
656 .na
657 \fB\fB7\fR\fR
658 .ad
659 .RS 6n
660 Aging option is disabled.
661 .RE
663 .sp
664 .ne 2
665 .na
666 \fB\fB8\fR\fR
667 .ad
668 .RS 6n
669 No memory.
670 .RE
672 .sp
673 .ne 2
674 .na
675 \fB\fB9\fR\fR
676 .ad
677 .RS 6n
678 System error.
679 .RE
681 .sp
682 .ne 2
683 .na
684 \fB\fB10\fR\fR
685 .ad
686 .RS 6n
687 Account expired.
688 .RE
690 .SH FILES
691 .ne 2
692 .na
693 \fB\fB/etc/default/passwd\fR\fR
694 .ad
695 .RS 23n
696 Default values can be set for the following flags in \fB/etc/default/passwd\fR.
697 For example: \fBMAXWEEKS=26\fR
698 .sp
699 .ne 2
700 .na
701 \fB\fBDICTIONDBDIR\fR\fR
702 .ad
703 .RS 16n
704 The directory where the generated dictionary databases reside. Defaults to
705 \fB/var/passwd\fR.
706 .sp
707 If neither \fBDICTIONLIST\fR nor \fBDICTIONDBDIR\fR is specified, the system
708 does not perform a dictionary check.
709 .RE
711 .sp
712 .ne 2
713 .na
714 \fB\fBDICTIONLIST\fR\fR
715 .ad
716 .RS 16n
717 DICTIONLIST can contain list of comma separated dictionary files such as
718 \fBDICTIONLIST=\fR\fIfile1\fR, \fIfile2\fR, \fIfile3\fR. Each dictionary file
719 contains multiple lines and each line consists of a word and a NEWLINE
720 character (similar to \fB/usr/share/lib/dict/words\fR.) You must specify full
721 pathnames. The words from these files are merged into a database that is used
722 to determine whether a password is based on a dictionary word.
723 .sp
724 If neither \fBDICTIONLIST\fR nor \fBDICTIONDBDIR\fR is specified, the system
725 does not perform a dictionary check.
726 .sp
727 To pre-build the dictionary database, see \fBmkpwdict\fR(8).
728 .RE
730 .sp
731 .ne 2
732 .na
733 \fB\fBHISTORY\fR\fR
734 .ad
735 .RS 16n
736 Maximum number of prior password history to keep for a user. Setting the
737 \fBHISTORY\fR value to zero (\fB0\fR), or removing the flag, causes the prior
738 password history of all users to be discarded at the next password change by
739 any user. The default is not to define the \fBHISTORY\fR flag. The maximum
740 value is \fB26.\fR Currently, this functionality is enforced only for user
741 accounts defined in the \fBfiles\fR name service (local
742 \fBpasswd\fR(4)/\fBshadow\fR(4)).
743 .RE
745 .sp
746 .ne 2
747 .na
748 \fB\fBMAXREPEATS\fR\fR
749 .ad
750 .RS 16n
751 Maximum number of allowable consecutive repeating characters. If
752 \fBMAXREPEATS\fR is not set or is zero (\fB0\fR), the default is no checks
753 .RE
755 .sp
756 .ne 2
757 .na
758 \fB\fBMAXWEEKS\fR\fR
759 .ad
760 .RS 16n
761 Maximum time period that password is valid.
762 .RE
764 .sp
765 .ne 2
766 .na
767 \fB\fBMINALPHA\fR\fR
768 .ad
769 .RS 16n
770 Minimum number of alpha character required. If \fBMINALPHA\fR is not set, the
771 default is \fB2\fR.
772 .RE
774 .sp
775 .ne 2
776 .na
777 \fB\fBMINDIFF\fR\fR
778 .ad
779 .RS 16n
780 Minimum differences required between an old and a new password. If
781 \fBMINDIFF\fR is not set, the default is \fB3\fR.
782 .RE
784 .sp
785 .ne 2
786 .na
787 \fB\fBMINDIGIT\fR\fR
788 .ad
789 .RS 16n
790 Minimum number of digits required. If \fBMINDIGIT\fR is not set or is set to
791 zero (\fB0\fR), the default is no checks. You cannot be specify \fBMINDIGIT\fR
792 if \fBMINNONALPHA\fR is also specified.
793 .RE
795 .sp
796 .ne 2
797 .na
798 \fB\fBMINLOWER\fR\fR
799 .ad
800 .RS 16n
801 Minimum number of lower case letters required. If not set or zero (0), the
802 default is no checks.
803 .RE
805 .sp
806 .ne 2
807 .na
808 \fB\fBMINNONALPHA\fR\fR
809 .ad
810 .RS 16n
811 Minimum number of non-alpha (including numeric and special) required. If
812 \fBMINNONALPHA\fR is not set, the default is \fB1\fR. You cannot specify
813 \fBMINNONALPHA\fR if \fBMINDIGIT\fR or \fBMINSPECIAL\fR is also specified.
814 .RE
816 .sp
817 .ne 2
818 .na
819 \fB\fBMINWEEKS\fR\fR
820 .ad
821 .RS 16n
822 Minimum time period before the password can be changed.
823 .RE
825 .sp
826 .ne 2
827 .na
828 \fB\fBMINSPECIAL\fR\fR
829 .ad
830 .RS 16n
831 Minimum number of special (non-alpha and non-digit) characters required. If
832 \fBMINSPECIAL\fR is not set or is zero (\fB0\fR), the default is no checks. You
833 cannot specify \fBMINSPECIAL\fR if you also specify \fBMINNONALPHA\fR.
834 .RE
836 .sp
837 .ne 2
838 .na
839 \fB\fBMINUPPER\fR\fR
840 .ad
841 .RS 16n
842 Minimum number of upper case letters required. If \fBMINUPPER\fR is not set or
843 is zero (\fB0\fR), the default is no checks.
844 .RE
846 .sp
847 .ne 2
848 .na
849 \fB\fBNAMECHECK\fR\fR
850 .ad
851 .RS 16n
852 Enable/disable checking or the login name. The default is to do login name
853 checking. A case insensitive value of \fBno\fR disables this feature.
854 .RE
856 .sp
857 .ne 2
858 .na
859 \fB\fBPASSLENGTH\fR\fR
860 .ad
861 .RS 16n
862 Minimum length of password, in characters.
863 .RE
865 .sp
866 .ne 2
867 .na
868 \fB\fBWARNWEEKS\fR\fR
869 .ad
870 .RS 16n
871 Time period until warning of date of password's ensuing expiration.
872 .RE
874 .sp
875 .ne 2
876 .na
877 \fB\fBWHITESPACE\fR\fR
878 .ad
879 .RS 16n
880 Determine if white space characters are allowed in passwords. Valid values are
881 \fBYES\fR and \fBNO\fR. If \fBWHITESPACE\fR is not set or is set to \fBYES\fR,
882 white space characters are allowed.
883 .RE
885 .RE
887 .sp
888 .ne 2
889 .na
890 \fB\fB/etc/oshadow\fR\fR
891 .ad
892 .RS 23n
893 Temporary file used by \fBpasswd\fR and \fBpassmgmt\fR to update the real
894 shadow file.
895 .RE
897 .sp
898 .ne 2
899 .na
900 \fB\fB/etc/passwd\fR\fR
901 .ad
902 .RS 23n
903 Password file.
904 .RE
906 .sp
907 .ne 2
908 .na
909 \fB\fB/etc/shadow\fR\fR
910 .ad
911 .RS 23n
912 Shadow password file.
913 .RE
915 .sp
916 .ne 2
917 .na
918 \fB\fB/etc/shells\fR\fR
919 .ad
920 .RS 23n
921 Shell database.
922 .RE
924 .SH ATTRIBUTES
925 .LP
926 See \fBattributes\fR(5) for descriptions of the following attributes:
927 .sp
929 .sp
930 .TS
931 box;
932 c | c
933 l | l .
934 ATTRIBUTE TYPE ATTRIBUTE VALUE
935 _
936 CSI Enabled
937 _
938 Interface Stability See below.
939 .TE
941 .sp
942 .LP
943 The human readable output is Uncommitted. The options are Committed.
944 .SH SEE ALSO
945 .LP
946 \fBat\fR(1), \fBbatch\fR(1), \fBfinger\fR(1), \fBkpasswd\fR(1), \fBlogin\fR(1),
947 \fBcron\fR(8), \fBdomainname\fR(8), \fBeeprom\fR(8),
948 \fBid\fR(8), \fBldapclient\fR(8), \fBmkpwdict\fR(8), \fBpassmgmt\fR(8),
949 \fBsu\fR(8), \fBuseradd\fR(8), \fBuserdel\fR(8),
950 \fBusermod\fR(8), \fBcrypt\fR(3C), \fBgetpwnam\fR(3C), \fBgetspnam\fR(3C),
951 \fBgetusershell\fR(3C), \fBpam\fR(3PAM),
952 \fBloginlog\fR(4), \fBnsswitch.conf\fR(4), \fBpam.conf\fR(4), \fBpasswd\fR(4),
953 \fBpolicy.conf\fR(4), \fBshadow\fR(4), \fBshells\fR(4), \fBattributes\fR(5),
954 \fBenviron\fR(5), \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
955 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_ldap\fR(5),
956 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), \fBpam_unix_session\fR(5)
957 .SH NOTES
958 .LP
959 The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is
960 provided by \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5),
961 \fBpam_unix_session\fR(5), \fBpam_authtok_check\fR(5),
962 \fBpam_authtok_get\fR(5), \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), and
963 \fBpam_passwd_auth\fR(5).
964 .sp
965 .LP
966 The \fByppasswd\fR command is a wrapper around \fBpasswd\fR. Use of
967 \fByppasswd\fR is discouraged. Use \fBpasswd\fR \fB-r\fR \fIrepository_name\fR
968 instead.
969 .sp
970 .LP
971 Changing a password in the \fBfiles\fR and \fBldap\fR repositories clears the
972 failed login count.
973 .sp
974 .LP
975 Changing a password reactivates an account deactivated for inactivity for the
976 length of the inactivity period.
977 .sp
978 .LP
979 If \fB/etc/shells\fR is present, and is corrupted, it may provide an attack
980 vector that would compromise the system. The \fBgetusershell\fR(3c) library
981 call has a pre-vetted list of shells, so /etc/shells should be used with
982 caution.
983 .sp
984 .LP
985 Input terminal processing might interpret some key sequences and not pass them
986 to the \fBpasswd\fR command.
987 .sp
988 .LP
989 An account with no password, status code \fBNP\fR, might not be able to login.
990 See the \fBlogin\fR(1) \fBPASSREQ\fR option.