Subject: Re: solving various bug reports...
To: None <tech-security@NetBSD.ORG>
From: Jukka Marin <jmarin@pyy.jmp.fi>
List: tech-security
Date: 07/01/1997 08:13:43
On Mon, Jun 30, 1997 at 10:58:41PM -0400, Greg A. Woods wrote:

> > 4. login(1) patch to force password change on initial login
> > -----------------------------------------------------------
> > 
> > PR 936 adds support for a "magic" password change date to force users
> > to change their passwords on initial login.
> > 
> > This is good. I'd also add support to su(1) for this, and ensure that
> > the value for the "magic" change is
> >     a) in <pwd.h>
> >     b) documented in passwd(1), passwd(5), and elsewhere
> 
> another VERY good idea the rest of the world has had for nearly 2 decades....
> 
> (well, at least the SysV world!  ;-)

Also, the user should be allowed to change his/her password after it has
expired.  AIX has this, at least.  As it is now, root is required to adjust
the password expire date to let the user log on and change the password.

  -jm


-- 

                       1503 kHz @ 22:30 EET DST Mon-Fri

                     ---> http://www.jmp.fi/~jmarin/ <---