Change eight command issues per user and to use that command, which, by the way, I will show you
in the later lecture how we could use that command to specify those number of minimum days, maximum
days, last day, inactive expiry date and warning.
And as you notice at the end, it says user.
So you make that change to per user basis.
Now, what if you want to set those default values for every users that is created in your system?
What that means is what if you have to create 10 users?
Would you run c, h, h command for every you to set the maximum days that is allowed to have the password
one by one?
Or would you rather have that value set in some kind of default configuration where every time users
created that value is automatically set for that user?
For that, there was a while ago, it's called ETSI Log in default.
In that file you'll see there was a pass underscore Max and called days value, minimum days, minimum
length, warning age.
All those settings can be set up as a parameters in that file.
So let's look at that file really quick.
And here I have my Linux machine open.
I am logged in as a root and I will go ahead and do more.
Aren't at sea log in the defaults file, by the way, it's def default, not def.
That's just a mistake on my slide.
So please make that note.
When you enter, you will see right here everything that is set up as a hash sign means it's just a
comment.
This is the path for aging control.
Let's go down one page and this is what I'm talking about.
If you make the change here and specify the default settings that is based on your corporate or your
company requirements, you could set that up.
And then next time you create a user account will have that set setting apply to every user account.
Also, there are other values that could set in this file as well.
So every time you create a user menu, max value for automatic, you add selection user add.
Whenever you run that user add command, the value of the UID is assigned by default to that user.
It starts with one thousand.
So if you wanted to make that more secure, sometimes I have seen in corporate environment they start
the user ID with 10000 or 20000 or a number that cannot be guess easily.
You could put that in uid max meaning from one thousand to sixty thousand you could have a total of
fifty nine thousand users.
Or you cannot assign anything that any I.D. to a user, which is like let's say 60000 one sis, user
ID, minimum system user Max.
This is they use it for the systems processes, anything that is set up as a system process user.
There are other ones as group user group Max.
The same way that for the users Kreenholm directory.
Yes.
Every time you run user add comment, it will create an ID and group and encryption method that is set
by default.
Remember in the last slide I went over there five different settings and the setting that is used to
create the user encryption off that user password is SSA 512.
Now you're probably wondering what is those SSTO 512 and different encryption?
Trust me, that gets very complicated and I don't want to get into that right now.
If you really wanted to learn more about those encryption, I have a recommend you to go ahead and search
online and I'm sure you'll find tons of information on that.
You may ask is when you create a user, every time they use a creates a file, that file gets created
with specific permissions and open missions are actually assigned it right here.
And that, you may ask, permissions will be given to every use of that is created anywhere.
This file guys, remember, this file is very important.
ATSE log in the defaults that file is actually controls how the passwords age minimum maximum is set
for each user.
And it is very, very important for you to know this file when someone is, uh, is in the corporate
environment and wants to tighten up the security that person always have to start with as user level.
That is why in my lectures, the first section that I'm going through, the security part is at the
user level.
And when you talk about creating users, this file is the one you really need to remember.
Now, in the coming lecture, I'll show you how to use the c, h, c, h, h command that could be used
to set these user password minimum days in H.
OK, now we are actually going to run the S.H. age command, so it's not changed again.
C.H. Age, so change age.
That comment is specifically used to set parameters around the password.
It is not used to make any changes to the user account itself to change or make any changes to the user
account.
You will use user mod, which we learned in the previous lecture.
OK, the command is again, as I said before, is per user basis.
You could actually run the command S.H. age with minus D minus M and all different options that we cover.
Again, minus D is for last password minus four minimum minus uppercase.
As for maximum minus W is for warning, minus is for inactive minus E4 to expire.
OK, now let's get into my next machine right away.
OK, so we know the account exist, we have created we verified it, now we are going to make the change
that Babou but password parameters before we make the change, let's grep for Barbu and at the shadow
file, since I only have one Barbu so I could just simply grab for Bubu instead of the complete name
Barbu.
But OK, here you'll notice it has all the default information, the username, the password, the last
password change minimum and all of the parameters, same default value.
These are the value from here till the end are the value we are going to change.
And again, the reason we're making this change is so we could secure our environment.
And of course, our entire topic is about securing the environment.
So we make that change for what?
For one specific user to change the environment.
Now, to run the command S.H. age, you could do minus a D for last day.
And I would not like to make that change because I want it to be consistent with the systems time and
the system.
Time is days since January 1st, 1970 that the password was last changed.
If I make that change right now, I won't have I can't keep track of the password change.
So right now, if I take this number and minus the date of January 1st, 1970, then I could tell the
password was changed today.
So I don't want to make that change.
I wanted to keep that for my own information.
So I will start with minus M, which says minimum.
What is that minimum?
The minimum number of days required between password changes.
That is the number of days left before the user is allowed to change his or her password.
Meaning if you are changing password today and if I make this five right now, it means you cannot change
the password until those five days has already been passed.
So right now I notice it is set to zero, meaning there is no restriction.
But for this exercise, I'll put five.
Next one.
We have uppercase M, which is maximum.
What does this maximum mean?
It means the maximum number of days.
A password is valid after that uses force to change his or her password.
So right now, the total number of days I have to change my password is nine nine nine nine nine, which
is a lot too many days.
So the system is not going to prompt the user to change his or her password until that day comes.
And of course, hopefully we all live to that age, but that's not possible.
So it's good to make the user change his or her password every, let's say, three months.
That makes it ninety days.
I will put nine zero.
So every 90 days the system will prompt this user, hey, your password is expiring, so please go ahead
and change the person.
Then the number six is morning.
So for warning meaning before it expires.
So I want the system to notify the user ten days before the password expires, which is ninety.
So I'm going to put ten.
So automatically the system does the calculation for you and it will see, hey, the maximum number
of days.
And so I have to remind to remind the person ten days before next one is minus E is an active.
That means the number of days after password expires, the account is disabled.
So if your password expires today, your account will be disabled tomorrow, day after tomorrow or whenever
that is specified right here.
So I will say delete disable account.
If the password is not changed, disable it after three days.
OK, the last one is expired, which I pick e sorry.
This inactive one was I and the last expired days since this account is disable that is an absolute
date.
Specify when the login may no longer be used so you can specify a number when the password is actually
completely expires.
Actually the only one inactive one is an anak dev meaning it's making the account is inactive now expire
one days since January 1st, 1970.
That account is disabled.
So it will does the calculation until that account is disabled.
So for now you can leave that.
OK, so I.
Just ran the command and gave me an error message.
OK, now I know why it gave me an error message is because I forgot to specify the username.
Which user am I going?
Am I picking to make that change to.
That is why I'm getting this option.
So that is Bubu.
But OK, so it took it and it gave me the back.
Now I am going to view these parameters in Etsi Shadowfax so I'll do grab Bubu but.
See?
Chateau.
And here you'll see I didn't pick the minus D, which is the last day of the last display you can make
your own last day, from which I would date if you want, but I'm just leaving it to system default.
That's why I didn't pick the next one.
If you notice, I have number five, which was a minimum date I picked right here.
Then the next one is maximum.
It has to remind the user to change the password, force the user to change the password up to 90 days.
And then the next one is W is a warning, a reminder 10 days before and seven is that seven and and
activate the the user account after three days of password expiring.
So that's how the S.H. age password works.
Parameters to change it.
If you again, if you wanted to make that change throughout your systems, then which file do you have
to modify.
Yes.
Etsi login defaults and that's a common practice of recommend you can modify there.
But if you are making changes to a few users, only then I would recommend that you see each each commit.
So that's one of the command that is mostly used for securing your user environment.