| blob | cf8479f0ddb1733d1f45ea0ba89ed218a3446592 |
1 '\" te
2 .\" Copyright 1989 AT&T
3 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
5 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the
6 .\" fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH PASSWD 1 "Feb 25, 2017"
8 .SH NAME
9 passwd \- change login password and password attributes
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fBpasswd\fR [\fB-r\fR files | \fB-r\fR ldap | \fB-r\fR nis] [\fIname\fR]
14 .fi
16 .LP
17 .nf
18 \fBpasswd\fR [\fB-r\fR files] [\fB-egh\fR] [\fIname\fR]
19 .fi
21 .LP
22 .nf
23 \fBpasswd\fR [\fB-r\fR files] \fB-s\fR [\fB-a\fR]
24 .fi
26 .LP
27 .nf
28 \fBpasswd\fR [\fB-r\fR files] \fB-s\fR [\fIname\fR]
29 .fi
31 .LP
32 .nf
33 \fBpasswd\fR [\fB-r\fR files] [\fB-d\fR | \fB-l\fR | \fB-u\fR | \fB-N\fR] [\fB-f\fR] [\fB-n\fR \fImin\fR]
34 [\fB-w\fR \fIwarn\fR] [\fB-x\fR \fImax\fR] \fIname\fR
35 .fi
37 .LP
38 .nf
39 \fBpasswd\fR \fB-r\fR ldap [\fB-egh\fR] [\fIname\fR]
40 .fi
42 .LP
43 .nf
44 \fBpasswd\fR [\fB-r\fR ldap ] \fB-s\fR [\fB-a\fR]
45 .fi
47 .LP
48 .nf
49 \fBpasswd\fR [\fB-r\fR ldap ] \fB-s\fR [\fIname\fR]
50 .fi
52 .LP
53 .nf
54 \fBpasswd\fR \fB-r\fR ldap [\fB-d | -l | -u | -N\fR] [\fB-f\fR] [\fB-n\fR \fImin\fR] [\fB-w\fR \fIwarn\fR] [\fB-x\fR \fImax\fR] \fIname\fR
55 .fi
57 .LP
58 .nf
59 \fBpasswd\fR \fB-r\fR nis [\fB-egh\fR] [\fIname\fR]
60 .fi
62 .SH DESCRIPTION
63 .LP
64 The \fBpasswd\fR command changes the password or lists password attributes
65 associated with the user's login \fIname\fR. Additionally, privileged users can
66 use \fBpasswd\fR to install or change passwords and attributes associated with
67 any login \fIname\fR.
68 .sp
69 .LP
70 When used to change a password, \fBpasswd\fR prompts everyone for their old
71 password, if any. It then prompts for the new password twice. When the old
72 password is entered, \fBpasswd\fR checks to see if it has aged sufficiently. If
73 \fBaging\fR is insufficient, \fBpasswd\fR terminates; see \fBpwconv\fR(1M)
74 and \fBshadow\fR(4) for additional information.
75 .sp
76 .LP
77 The \fBpwconv\fR command creates and updates \fB/etc/shadow\fR with information
78 from \fB/etc/passwd\fR. \fBpwconv\fR relies on a special value of \fBx\fR in
79 the password field of \fB/etc/passwd\fR. This value of \fBx\fR indicates that
80 the password for the user is already in \fB/etc/shadow\fR and should not be
81 modified.
82 .sp
83 .LP
84 If aging is sufficient, a check is made to ensure that the new password meets
85 construction requirements. When the new password is entered a second time, the
86 two copies of the new password are compared. If the two copies are not
87 identical, the cycle of prompting for the new password is repeated for, at
88 most, two more times.
89 .sp
90 .LP
91 Passwords must be constructed to meet the following requirements:
92 .RS +4
93 .TP
94 .ie t \(bu
95 .el o
96 Each password must have \fBPASSLENGTH\fR characters, where \fBPASSLENGTH\fR is
97 defined in \fB/etc/default/passwd\fR and is set to \fB6\fR. Setting
98 \fBPASSLENGTH\fR to more than eight characters requires configuring
99 \fBpolicy.conf\fR(4) with an algorithm that supports greater than eight
100 characters.
101 .RE
102 .RS +4
103 .TP
104 .ie t \(bu
105 .el o
106 Each password must meet the configured complexity constraints specified in
107 \fB/etc/default/passwd\fR.
108 .RE
109 .RS +4
110 .TP
111 .ie t \(bu
112 .el o
113 Each password must not be a member of the configured dictionary as specified in
114 \fB/etc/default/passwd\fR.
115 .RE
116 .RS +4
117 .TP
118 .ie t \(bu
119 .el o
120 For accounts in name services which support password history checking, if prior
121 password history is defined, new passwords must not be contained in the prior
122 password history.
123 .RE
124 .sp
125 .LP
126 If all requirements are met, by default, the \fBpasswd\fR command consults
127 \fB/etc/nsswitch.conf\fR to determine in which repositories to perform password
128 update. It searches the \fBpasswd\fR and \fBpasswd_compat\fR entries. The
129 sources (repositories) associated with these entries are updated. However, the
130 password update configurations supported are limited to the following cases.
131 Failure to comply with the configurations prevents users from logging onto the
132 system. The password update configurations are:
133 .RS +4
134 .TP
135 .ie t \(bu
136 .el o
137 \fBpasswd: files\fR
138 .RE
139 .RS +4
140 .TP
141 .ie t \(bu
142 .el o
143 \fBpasswd: files ldap\fR
144 .RE
145 .RS +4
146 .TP
147 .ie t \(bu
148 .el o
149 \fBpasswd: files nis\fR
150 .RE
151 .RS +4
152 .TP
153 .ie t \(bu
154 .el o
155 \fBpasswd: compat\fR (==> files nis)
156 .RE
157 .RS +4
158 .TP
159 .ie t \(bu
160 .el o
161 \fBpasswd: compat\fR (==> files ldap)
162 .sp
163 \fBpasswd_compat: ldap\fR
164 .RE
165 .sp
166 .LP
167 You can add the \fBad\fR keyword to any of the \fBpasswd\fR configurations in
168 the above list. However, you cannot use the \fBpasswd\fR command to change the
169 password of an Active Directory (AD) user. If the \fBad\fR keyword is found in
170 the \fBpasswd\fR entry during a password update operation, it is ignored. To
171 update the password of an AD user, use the \fBkpasswd\fR(1) command.
172 .sp
173 .LP
174 The administrator configured for updating LDAP shadow
175 information can change any password attributes. See \fBldapclient\fR(1M).
176 .sp
177 .LP
178 When a user has a password stored in one of the name services as well as a
179 local \fBfiles\fR entry, the \fBpasswd\fR command updates both. It is possible
180 to have different passwords in the name service and local files entry. Use
181 \fBpasswd\fR \fB-r\fR to change a specific password repository.
182 .sp
183 .LP
184 In the \fBfiles\fR case, super-users (for instance, real and effective uid
185 equal to \fB0\fR, see \fBid\fR(1M) and \fBsu\fR(1M)) can change any password.
186 Hence, \fBpasswd\fR does not prompt privileged users for the old password.
187 Privileged users are not forced to comply with password aging and password
188 construction requirements. A privileged user can create a null password by
189 entering a carriage return in response to the prompt for a new password. (This
190 differs from \fBpasswd\fR \fB-d\fR because the \fBpassword\fR prompt is still
191 displayed.) If NIS is in effect, superuser on the root master can change any
192 password without being prompted for the old NIS \fBpasswd\fR, and is not forced
193 to comply with password construction requirements.
194 .sp
195 .LP
196 If LDAP is in effect, superuser on any Native LDAP client system can change any
197 password without being prompted for the old LDAP passwd, and is not forced to
198 comply with password construction requirements.
199 .sp
200 .LP
201 Normally, \fBpasswd\fR entered with no arguments changes the password of the
202 current user. When a user logs in and then invokes \fBsu\fR(1M) to become
203 superuser or another user, \fBpasswd\fR changes the original user's password,
204 not the password of the superuser or the new user.
205 .sp
206 .LP
207 Any user can use the \fB-s\fR option to show password attributes for his or her
208 own login \fIname\fR. Otherwise, the \fB-s\fR argument is restricted to the
209 superuser.
210 .sp
211 .LP
212 The format of the display is:
213 .sp
214 .in +2
215 .nf
216 \fIname status mm/dd/yy min max warn\fR
217 .fi
218 .in -2
219 .sp
221 .sp
222 .LP
223 or, if password aging information is not present,
224 .sp
225 .in +2
226 .nf
227 \fIname status\fR
228 .fi
229 .in -2
230 .sp
232 .sp
233 .LP
234 where
235 .sp
236 .ne 2
237 .na
238 \fB\fIname\fR\fR
239 .ad
240 .RS 12n
241 The login \fBID\fR of the user.
242 .RE
244 .sp
245 .ne 2
246 .na
247 \fB\fIstatus\fR\fR
248 .ad
249 .RS 12n
250 The password status of \fIname\fR.
251 .sp
252 The \fIstatus\fR field can take the following values:
253 .sp
254 .ne 2
255 .na
256 \fBLK\fR
257 .ad
258 .RS 6n
259 This account is \fBlocked\fR account. See Security.
260 .RE
262 .sp
263 .ne 2
264 .na
265 \fBNL\fR
266 .ad
267 .RS 6n
268 This account is a \fBno login\fR account. See \fBSecurity\fR.
269 .RE
271 .sp
272 .ne 2
273 .na
274 \fBNP\fR
275 .ad
276 .RS 6n
277 This account has no password and is therefore open without authentication.
278 .RE
280 .sp
281 .ne 2
282 .na
283 \fBPS\fR
284 .ad
285 .RS 6n
286 This account has a password.
287 .RE
289 .RE
291 .sp
292 .ne 2
293 .na
294 \fB\fImm/dd/yy\fR\fR
295 .ad
296 .RS 12n
297 The date password was last changed for \fIname\fR. All password aging dates are
298 determined using Greenwich Mean Time (Universal Time) and therefore can differ
299 by as much as a day in other time zones.
300 .RE
302 .sp
303 .ne 2
304 .na
305 \fB\fImin\fR\fR
306 .ad
307 .RS 12n
308 The minimum number of days required between password changes for \fIname\fR.
309 \fBMINWEEKS\fR is found in \fB/etc/default/passwd\fR and is set to \fBNULL\fR.
310 .RE
312 .sp
313 .ne 2
314 .na
315 \fB\fImax\fR\fR
316 .ad
317 .RS 12n
318 The maximum number of days the password is valid for \fIname\fR. \fBMAXWEEKS\fR
319 is found in \fB/etc/default/passwd\fR and is set to \fBNULL\fR.
320 .RE
322 .sp
323 .ne 2
324 .na
325 \fB\fIwarn\fR\fR
326 .ad
327 .RS 12n
328 The number of days relative to \fImax\fR before the password expires and the
329 \fIname\fR are warned.
330 .RE
332 .SS "Security"
333 .LP
334 \fBpasswd\fR uses \fBpam\fR(3PAM) for password change. It calls PAM with a
335 service name \fBpasswd\fR and uses service module type \fBauth\fR for
336 authentication and password for password change.
337 .sp
338 .LP
339 Locking an account (\fB-l\fR option) does not allow its use for password based
340 login or delayed execution (such as \fBat\fR(1), \fBbatch\fR(1), or
341 \fBcron\fR(1M)). The \fB-N\fR option can be used to disallow password based
342 login, while continuing to allow delayed execution.
343 .SH OPTIONS
344 .LP
345 The following options are supported:
346 .sp
347 .ne 2
348 .na
349 \fB\fB-a\fR\fR
350 .ad
351 .RS 17n
352 Shows password attributes for all entries. Use only with the \fB-s\fR option.
353 \fIname\fR must not be provided. For the \fBfiles\fR and \fBldap\fR
354 repositories, this is restricted to the superuser.
355 .RE
357 .sp
358 .ne 2
359 .na
360 \fB\fB-e\fR\fR
361 .ad
362 .RS 17n
363 Changes the login shell. The choice of shell is limited by the requirements
364 of \fBgetusershell\fR(3C). If the user currently has a shell that is not
365 allowed by \fBgetusershell\fR, only root can change it.
366 .RE
368 .sp
369 .ne 2
370 .na
371 \fB\fB-g\fR\fR
372 .ad
373 .RS 17n
374 Changes the gecos (finger) information. For the \fBfiles\fR repository, this
375 only works for the superuser. Normal users can change the \fBldap\fR or
376 \fBnis\fR repositories.
377 .RE
379 .sp
380 .ne 2
381 .na
382 \fB\fB-h\fR\fR
383 .ad
384 .RS 17n
385 Changes the home directory.
386 .RE
388 .sp
389 .ne 2
390 .na
391 \fB\fB-r\fR\fR
392 .ad
393 .RS 17n
394 Specifies the repository to which an operation is applied. The supported
395 repositories are \fBfiles\fR, \fBldap\fR, or \fBnis\fR.
396 .RE
398 .sp
399 .ne 2
400 .na
401 \fB\fB-s\fR \fIname\fR\fR
402 .ad
403 .RS 17n
404 Shows password attributes for the login \fIname\fR. For the \fBfiles\fR and
405 \fBldap\fR repositories, this only works for the superuser. It does not work
406 at all for the \fBnis\fR repository which does not support password aging.
407 .sp
408 The output of this option, and only this option is Stable and parsable. The
409 format is \fIusername\fR followed by white space followed by one of the
410 following codes.
411 .sp
412 New codes might be added in the future so code that parses this must be
413 flexible in the face of unknown codes. While all existing codes are two
414 characters in length that might not always be the case.
415 .sp
416 The following are the current status codes:
417 .sp
418 .ne 2
419 .na
420 \fB\fBLK\fR\fR
421 .ad
422 .RS 6n
423 Account is locked for UNIX authentication. \fBpasswd -l\fR was run or the
424 authentication failed \fBRETRIES\fR times.
425 .RE
427 .sp
428 .ne 2
429 .na
430 \fB\fBNL\fR\fR
431 .ad
432 .RS 6n
433 The account is a no login account. \fBpasswd -N\fR has been run.
434 .RE
436 .sp
437 .ne 2
438 .na
439 \fB\fBNP\fR\fR
440 .ad
441 .RS 6n
442 Account has no password. \fBpasswd -d\fR was run.
443 .RE
445 .sp
446 .ne 2
447 .na
448 \fB\fBPS\fR\fR
449 .ad
450 .RS 6n
451 The account probably has a valid password.
452 .RE
454 .sp
455 .ne 2
456 .na
457 \fB\fBUN\fR\fR
458 .ad
459 .RS 6n
460 The data in the password field is unknown. It is not a recognizable hashed
461 password or any of the above entries. See \fBcrypt\fR(3C) for valid password
462 hashes.
463 .RE
465 .RE
467 .SS "Privileged User Options"
468 .LP
469 Only a privileged user can use the following options:
470 .sp
471 .ne 2
472 .na
473 \fB\fB-d\fR\fR
474 .ad
475 .RS 11n
476 Deletes password for \fIname\fR and unlocks the account. The login \fIname\fR
477 is not prompted for password. It is only applicable to the \fBfiles\fR and
478 \fBldap\fR repositories.
479 .sp
480 If the \fBlogin\fR(1) option \fBPASSREQ=YES\fR is configured, the account is
481 not able to login. \fBPASSREQ=YES\fR is the delivered default.
482 .RE
484 .sp
485 .ne 2
486 .na
487 \fB\fB-f\fR\fR
488 .ad
489 .RS 11n
490 Forces the user to change password at the next login by expiring the password
491 for \fIname\fR.
492 .RE
494 .sp
495 .ne 2
496 .na
497 \fB\fB-l\fR\fR
498 .ad
499 .RS 11n
500 Locks password entry for \fIname\fR. See the \fB-d\fR or \fB-u\fR option for
501 unlocking the account.
502 .RE
504 .sp
505 .ne 2
506 .na
507 \fB\fB-N\fR\fR
508 .ad
509 .RS 11n
510 Makes the password entry for name a value that cannot be used for login, but
511 does not lock the account. See the \fB-d\fR option for removing the value, or
512 to set a password to allow logins.
513 .RE
515 .sp
516 .ne 2
517 .na
518 \fB\fB-n\fR \fImin\fR\fR
519 .ad
520 .RS 11n
521 Sets minimum field for \fIname\fR. The \fImin\fR field contains the minimum
522 number of days between password changes for \fIname\fR. If \fImin\fR is greater
523 than \fImax\fR, the user can not change the password. Always use this option
524 with the \fB-x\fR option, unless \fImax\fR is set to \fB\(mi1\fR (aging turned
525 off). In that case, \fImin\fR need not be set.
526 .RE
528 .sp
529 .ne 2
530 .na
531 \fB\fB-u\fR\fR
532 .ad
533 .RS 11n
534 Unlocks a locked password for entry name. See the \fB-d\fR option for removing
535 the locked password, or to set a password to allow logins.
536 .RE
538 .sp
539 .ne 2
540 .na
541 \fB\fB-w\fR \fIwarn\fR\fR
542 .ad
543 .RS 11n
544 Sets warn field for \fIname\fR. The \fIwarn\fR field contains the number of
545 days before the password expires and the user is warned. This option is not
546 valid if password aging is disabled.
547 .RE
549 .sp
550 .ne 2
551 .na
552 \fB\fB-x\fR \fImax\fR\fR
553 .ad
554 .RS 11n
555 Sets maximum field for \fIname\fR. The \fImax\fR field contains the number of
556 days that the password is valid for \fIname\fR. The aging for \fIname\fR is
557 turned off immediately if \fImax\fR is set to \fB\(mi1\fR\&.
558 .RE
560 .SH OPERANDS
561 .LP
562 The following operand is supported:
563 .sp
564 .ne 2
565 .na
566 \fB\fIname\fR\fR
567 .ad
568 .RS 8n
569 User login name.
570 .RE
572 .SH ENVIRONMENT VARIABLES
573 .LP
574 If any of the \fBLC_*\fR variables, that is, \fBLC_CTYPE\fR, \fBLC_MESSAGES\fR,
575 \fBLC_TIME\fR, \fBLC_COLLATE\fR, \fBLC_NUMERIC\fR, and \fBLC_MONETARY\fR (see
576 \fBenviron\fR(5)), are not set in the environment, the operational behavior of
577 \fBpasswd\fR for each corresponding locale category is determined by the value
578 of the \fBLANG\fR environment variable. If \fBLC_ALL\fR is set, its contents
579 are used to override both the \fBLANG\fR and the other \fBLC_*\fR variables. If
580 none of the above variables is set in the environment, the \fBC\fR (U.S. style)
581 locale determines how \fBpasswd\fR behaves.
582 .sp
583 .ne 2
584 .na
585 \fB\fBLC_CTYPE\fR\fR
586 .ad
587 .RS 15n
588 Determines how \fBpasswd\fR handles characters. When \fBLC_CTYPE\fR is set to a
589 valid value, \fBpasswd\fR can display and handle text and filenames containing
590 valid characters for that locale. \fBpasswd\fR can display and handle Extended
591 Unix Code (\fBEUC\fR) characters where any individual character can be 1, 2, or
592 3 bytes wide. \fBpasswd\fR can also handle \fBEUC\fR characters of 1, 2, or
593 more column widths. In the \fBC\fR locale, only characters from ISO 8859-1 are
594 valid.
595 .RE
597 .sp
598 .ne 2
599 .na
600 \fB\fBLC_MESSAGES\fR\fR
601 .ad
602 .RS 15n
603 Determines how diagnostic and informative messages are presented. This includes
604 the language and style of the messages, and the correct form of affirmative and
605 negative responses. In the \fBC\fR locale, the messages are presented in the
606 default form found in the program itself (in most cases, U.S. English).
607 .RE
609 .SH EXIT STATUS
610 .LP
611 The \fBpasswd\fR command exits with one of the following values:
612 .sp
613 .ne 2
614 .na
615 \fB\fB0\fR\fR
616 .ad
617 .RS 6n
618 Success.
619 .RE
621 .sp
622 .ne 2
623 .na
624 \fB\fB1\fR\fR
625 .ad
626 .RS 6n
627 Permission denied.
628 .RE
630 .sp
631 .ne 2
632 .na
633 \fB\fB2\fR\fR
634 .ad
635 .RS 6n
636 Invalid combination of options.
637 .RE
639 .sp
640 .ne 2
641 .na
642 \fB\fB3\fR\fR
643 .ad
644 .RS 6n
645 Unexpected failure. Password file unchanged.
646 .RE
648 .sp
649 .ne 2
650 .na
651 \fB\fB4\fR\fR
652 .ad
653 .RS 6n
654 Unexpected failure. Password file(s) missing.
655 .RE
657 .sp
658 .ne 2
659 .na
660 \fB\fB5\fR\fR
661 .ad
662 .RS 6n
663 Password file(s) busy. Try again later.
664 .RE
666 .sp
667 .ne 2
668 .na
669 \fB\fB6\fR\fR
670 .ad
671 .RS 6n
672 Invalid argument to option.
673 .RE
675 .sp
676 .ne 2
677 .na
678 \fB\fB7\fR\fR
679 .ad
680 .RS 6n
681 Aging option is disabled.
682 .RE
684 .sp
685 .ne 2
686 .na
687 \fB\fB8\fR\fR
688 .ad
689 .RS 6n
690 No memory.
691 .RE
693 .sp
694 .ne 2
695 .na
696 \fB\fB9\fR\fR
697 .ad
698 .RS 6n
699 System error.
700 .RE
702 .sp
703 .ne 2
704 .na
705 \fB\fB10\fR\fR
706 .ad
707 .RS 6n
708 Account expired.
709 .RE
711 .SH FILES
712 .ne 2
713 .na
714 \fB\fB/etc/default/passwd\fR\fR
715 .ad
716 .RS 23n
717 Default values can be set for the following flags in \fB/etc/default/passwd\fR.
718 For example: \fBMAXWEEKS=26\fR
719 .sp
720 .ne 2
721 .na
722 \fB\fBDICTIONDBDIR\fR\fR
723 .ad
724 .RS 16n
725 The directory where the generated dictionary databases reside. Defaults to
726 \fB/var/passwd\fR.
727 .sp
728 If neither \fBDICTIONLIST\fR nor \fBDICTIONDBDIR\fR is specified, the system
729 does not perform a dictionary check.
730 .RE
732 .sp
733 .ne 2
734 .na
735 \fB\fBDICTIONLIST\fR\fR
736 .ad
737 .RS 16n
738 DICTIONLIST can contain list of comma separated dictionary files such as
739 \fBDICTIONLIST=\fR\fIfile1\fR, \fIfile2\fR, \fIfile3\fR. Each dictionary file
740 contains multiple lines and each line consists of a word and a NEWLINE
741 character (similar to \fB/usr/share/lib/dict/words\fR.) You must specify full
742 pathnames. The words from these files are merged into a database that is used
743 to determine whether a password is based on a dictionary word.
744 .sp
745 If neither \fBDICTIONLIST\fR nor \fBDICTIONDBDIR\fR is specified, the system
746 does not perform a dictionary check.
747 .sp
748 To pre-build the dictionary database, see \fBmkpwdict\fR(1M).
749 .RE
751 .sp
752 .ne 2
753 .na
754 \fB\fBHISTORY\fR\fR
755 .ad
756 .RS 16n
757 Maximum number of prior password history to keep for a user. Setting the
758 \fBHISTORY\fR value to zero (\fB0\fR), or removing the flag, causes the prior
759 password history of all users to be discarded at the next password change by
760 any user. The default is not to define the \fBHISTORY\fR flag. The maximum
761 value is \fB26.\fR Currently, this functionality is enforced only for user
762 accounts defined in the \fBfiles\fR name service (local
763 \fBpasswd\fR(4)/\fBshadow\fR(4)).
764 .RE
766 .sp
767 .ne 2
768 .na
769 \fB\fBMAXREPEATS\fR\fR
770 .ad
771 .RS 16n
772 Maximum number of allowable consecutive repeating characters. If
773 \fBMAXREPEATS\fR is not set or is zero (\fB0\fR), the default is no checks
774 .RE
776 .sp
777 .ne 2
778 .na
779 \fB\fBMAXWEEKS\fR\fR
780 .ad
781 .RS 16n
782 Maximum time period that password is valid.
783 .RE
785 .sp
786 .ne 2
787 .na
788 \fB\fBMINALPHA\fR\fR
789 .ad
790 .RS 16n
791 Minimum number of alpha character required. If \fBMINALPHA\fR is not set, the
792 default is \fB2\fR.
793 .RE
795 .sp
796 .ne 2
797 .na
798 \fB\fBMINDIFF\fR\fR
799 .ad
800 .RS 16n
801 Minimum differences required between an old and a new password. If
802 \fBMINDIFF\fR is not set, the default is \fB3\fR.
803 .RE
805 .sp
806 .ne 2
807 .na
808 \fB\fBMINDIGIT\fR\fR
809 .ad
810 .RS 16n
811 Minimum number of digits required. If \fBMINDIGIT\fR is not set or is set to
812 zero (\fB0\fR), the default is no checks. You cannot be specify \fBMINDIGIT\fR
813 if \fBMINNONALPHA\fR is also specified.
814 .RE
816 .sp
817 .ne 2
818 .na
819 \fB\fBMINLOWER\fR\fR
820 .ad
821 .RS 16n
822 Minimum number of lower case letters required. If not set or zero (0), the
823 default is no checks.
824 .RE
826 .sp
827 .ne 2
828 .na
829 \fB\fBMINNONALPHA\fR\fR
830 .ad
831 .RS 16n
832 Minimum number of non-alpha (including numeric and special) required. If
833 \fBMINNONALPHA\fR is not set, the default is \fB1\fR. You cannot specify
834 \fBMINNONALPHA\fR if \fBMINDIGIT\fR or \fBMINSPECIAL\fR is also specified.
835 .RE
837 .sp
838 .ne 2
839 .na
840 \fB\fBMINWEEKS\fR\fR
841 .ad
842 .RS 16n
843 Minimum time period before the password can be changed.
844 .RE
846 .sp
847 .ne 2
848 .na
849 \fB\fBMINSPECIAL\fR\fR
850 .ad
851 .RS 16n
852 Minimum number of special (non-alpha and non-digit) characters required. If
853 \fBMINSPECIAL\fR is not set or is zero (\fB0\fR), the default is no checks. You
854 cannot specify \fBMINSPECIAL\fR if you also specify \fBMINNONALPHA\fR.
855 .RE
857 .sp
858 .ne 2
859 .na
860 \fB\fBMINUPPER\fR\fR
861 .ad
862 .RS 16n
863 Minimum number of upper case letters required. If \fBMINUPPER\fR is not set or
864 is zero (\fB0\fR), the default is no checks.
865 .RE
867 .sp
868 .ne 2
869 .na
870 \fB\fBNAMECHECK\fR\fR
871 .ad
872 .RS 16n
873 Enable/disable checking or the login name. The default is to do login name
874 checking. A case insensitive value of \fBno\fR disables this feature.
875 .RE
877 .sp
878 .ne 2
879 .na
880 \fB\fBPASSLENGTH\fR\fR
881 .ad
882 .RS 16n
883 Minimum length of password, in characters.
884 .RE
886 .sp
887 .ne 2
888 .na
889 \fB\fBWARNWEEKS\fR\fR
890 .ad
891 .RS 16n
892 Time period until warning of date of password's ensuing expiration.
893 .RE
895 .sp
896 .ne 2
897 .na
898 \fB\fBWHITESPACE\fR\fR
899 .ad
900 .RS 16n
901 Determine if white space characters are allowed in passwords. Valid values are
902 \fBYES\fR and \fBNO\fR. If \fBWHITESPACE\fR is not set or is set to \fBYES\fR,
903 white space characters are allowed.
904 .RE
906 .RE
908 .sp
909 .ne 2
910 .na
911 \fB\fB/etc/oshadow\fR\fR
912 .ad
913 .RS 23n
914 Temporary file used by \fBpasswd\fR, \fBpassmgmt\fR and \fBpwconv\fR to update
915 the real shadow file.
916 .RE
918 .sp
919 .ne 2
920 .na
921 \fB\fB/etc/passwd\fR\fR
922 .ad
923 .RS 23n
924 Password file.
925 .RE
927 .sp
928 .ne 2
929 .na
930 \fB\fB/etc/shadow\fR\fR
931 .ad
932 .RS 23n
933 Shadow password file.
934 .RE
936 .sp
937 .ne 2
938 .na
939 \fB\fB/etc/shells\fR\fR
940 .ad
941 .RS 23n
942 Shell database.
943 .RE
945 .SH ATTRIBUTES
946 .LP
947 See \fBattributes\fR(5) for descriptions of the following attributes:
948 .sp
950 .sp
951 .TS
952 box;
953 c | c
954 l | l .
955 ATTRIBUTE TYPE ATTRIBUTE VALUE
956 _
957 CSI Enabled
958 _
959 Interface Stability See below.
960 .TE
962 .sp
963 .LP
964 The human readable output is Uncommitted. The options are Committed.
965 .SH SEE ALSO
966 .LP
967 \fBat\fR(1), \fBbatch\fR(1), \fBfinger\fR(1), \fBkpasswd\fR(1), \fBlogin\fR(1),
968 \fBcron\fR(1M), \fBdomainname\fR(1M), \fBeeprom\fR(1M),
969 \fBid\fR(1M), \fBldapclient\fR(1M), \fBmkpwdict\fR(1M), \fBpassmgmt\fR(1M),
970 \fBpwconv\fR(1M), \fBsu\fR(1M), \fBuseradd\fR(1M), \fBuserdel\fR(1M),
971 \fBusermod\fR(1M), \fBcrypt\fR(3C), \fBgetpwnam\fR(3C), \fBgetspnam\fR(3C),
972 \fBgetusershell\fR(3C), \fBpam\fR(3PAM),
973 \fBloginlog\fR(4), \fBnsswitch.conf\fR(4), \fBpam.conf\fR(4), \fBpasswd\fR(4),
974 \fBpolicy.conf\fR(4), \fBshadow\fR(4), \fBshells\fR(4), \fBattributes\fR(5),
975 \fBenviron\fR(5), \fBpam_authtok_check\fR(5), \fBpam_authtok_get\fR(5),
976 \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), \fBpam_ldap\fR(5),
977 \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5), \fBpam_unix_session\fR(5)
978 .SH NOTES
979 .LP
980 The \fBpam_unix\fR(5) module is no longer supported. Similar functionality is
981 provided by \fBpam_unix_account\fR(5), \fBpam_unix_auth\fR(5),
982 \fBpam_unix_session\fR(5), \fBpam_authtok_check\fR(5),
983 \fBpam_authtok_get\fR(5), \fBpam_authtok_store\fR(5), \fBpam_dhkeys\fR(5), and
984 \fBpam_passwd_auth\fR(5).
985 .sp
986 .LP
987 The \fByppasswd\fR command is a wrapper around \fBpasswd\fR. Use of
988 \fByppasswd\fR is discouraged. Use \fBpasswd\fR \fB-r\fR \fIrepository_name\fR
989 instead.
990 .sp
991 .LP
992 Changing a password in the \fBfiles\fR and \fBldap\fR repositories clears the
993 failed login count.
994 .sp
995 .LP
996 Changing a password reactivates an account deactivated for inactivity for the
997 length of the inactivity period.
998 .sp
999 .LP
1000 If \fB/etc/shells\fR is present, and is corrupted, it may provide an attack
1001 vector that would compromise the system. The \fBgetusershell\fR(3c) library
1002 call has a pre-vetted list of shells, so /etc/shells should be used with
1003 caution.
1004 .sp
1005 .LP
1006 Input terminal processing might interpret some key sequences and not pass them
1007 to the \fBpasswd\fR command.
1008 .sp
1009 .LP
1010 An account with no password, status code \fBNP\fR, might not be able to login.
1011 See the \fBlogin\fR(1) \fBPASSREQ\fR option.