Josephine Lau writes


Hi,

My name is Josephine and I am trying to find out about the passowrd
protection provided by MPE/IX version 6.5 that has HP Security Monitor
package. The questions are as follows:
Q1. I understand that it provides password expiry and it would prompt users
to change password on a periodic basis. When the password expires,  users
are forced to enter a new one that cannot be the same as the old one (Am I
correct so far?). However what I would like to know is, how do we set the
'Password must not be the same as the previous say 10 passwords'. Can this
be done?

Q2. How do we set the system to limit the numbers of times the user is able
to be allowed to try to log on to the system. For example, I have
incorrectly keyed in my password for 3 times and I want the system to lock
my ID out and in order to re-activate the ID I would need either
a) my system adminitrator to reactivate my user ID or
b) the system to automatically re-set my user ID after X minutes.

I hope to be able to hear from you as soon as possible.
--------------------------------------------------------
Check out the Security Monitor manual at
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/mpeix/onlinedocs/32650-
90497/32650-90497_top.html&con=/mpeix/onlinedocs/32650-90497/00/00/5-con.htm
l&toc=/mpeix/onlinedocs/32650-90497/00/00/5-toc.html&searchterms=security%7c
monitor&queryid=20020530-084249

watch the wrap or go to http://docs.hp.com/ and go from there.

It appears from the documentation that your new password can't match the
expiring password.  There doesn't appear to be multiple generations of
expired passwords.

Effects of Expired User Passwords

Expiration of a password has the following effects on users:

       The global expired user password function causes the expiration only
of required user         passwords, regardless of whether required at the
user or account level.

       Required user passwords are marked for expiration at the beginning of
the warning period.      Thus, if a new user establishes a required password
after the start of the warning period,   that password is not affected by
the forced expiration. Of course, it will be affected by         the next
forced expiration.

       If a user's password has expired, and the user is forced to enter a
new password, it         cannot be the same as the one that just expired.

I haven't found anything with regards to user lock out after password
failure

Mike Berkowitz
Guess? Inc.

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *