Account password expiration

[Dan Nelson]

In the last episode (Jul 06), Mike Carlson said:
> Is there a way in 5.x to have account passwords expire every 180
> days? Or I should say N days really. I think this was once tunable in
> /etc/login.conf but thats has been repalced with PAM.
> 
> Anyway, I just need account passwords to expire every 180 days, any
> help is appreciated.

It looks like pam_unix does check the passwd-change field in
master.passwd, but I don't see any code that resets the field when a
password is updated.  The login.conf and passwd manpages refer to a
"passwordtime" capability, but libpam zeroes out the change field when
the passwd is changed.  

Try the following patch.  After rebuilding pam_unix.so, edit
/etc/login.conf, set "passwordtime" to some short value like "10m", run
"cap_mkdb /etc/login.conf", change a password, and see if it expires in
10 minutes.

Index: pam_unix.c
===================================================================
RCS file: /home/ncvs/src/lib/libpam/modules/pam_unix/pam_unix.c,v
retrieving revision 1.49
diff -u -r1.49 pam_unix.c
--- pam_unix.c	10 Feb 2004 10:13:21 -0000	1.49
+++ pam_unix.c	6 Jul 2005 20:14:06 -0000
@@ -371,8 +371,10 @@
 		if ((old_pwd = pw_dup(pwd)) == NULL)
 			return (PAM_BUF_ERR);
 
-		pwd->pw_change = 0;
 		lc = login_getclass(NULL);
+		pwd->pw_change = login_getcaptime(lc, "passwordtime", 0, 0);
+		if (pwd->pw_change)
+			pwd->pw_change += time(NULL);
 		if (login_setcryptfmt(lc, password_hash, NULL) == NULL)
 			openpam_log(PAM_LOG_ERROR,
 			    "can't set password cipher, relying on default");

-- 
	Dan Nelson
	dnelson at allantgroup.com