Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So under AIX 6, according to "lsuser" the user has the following settings:

maxexpired=-1
maxage=2

So this means that 2 weeks after the last password update of the user the password will expire, but because of the "maxexpired=-1" the password will never expire, and the user [that has for ex.: only FTP access] will not be locked out?

I'm asking because I got two different descriptions for "maxexpired":

"man" source #1:

enter image description here

"man" source #2:

maxexpired

Defines the maximum time (in weeks) beyond the maxage value that a user can change an expired password. After this defined time, only an administrative user can change the password. The value is a decimal integer string. The default is -1, indicating restriction is set. If the maxexpired attribute is 0, the password expires when the maxage value is met. If the maxage attribute is 0, the maxexpired attribute is ignored. Range: 0 to 52 (a root user is exempt from maxexpired)

share|improve this question
add comment

2 Answers

Once maxage is reached, the user cannot log on without changing his/her password.

If you set maxexpired to a positive value, the user can still change their expired password themselves (on login) during that many weeks. Past that delay, only an administrator can update the password (and thus the user cannot log in at all after that delay without help from an administrator).

When you set maxexpired to -1, this means that the user will be able to change their expired password (and thus log in) whenever they want - they won't need assistance from an administrator to be able to update their password and log back in.

share|improve this answer
    
I'm on this opinion too, but I need confirmation for this that it's 100% true. –  LanceBaynes Nov 12 '11 at 16:21
    
I don't get what you don't understand from the documentation. A password must be changed after it has expired (see the maxage docs). The maxexpired is just an (optional and possibly infinite) grace period. –  Mat Nov 12 '11 at 16:38
    
I just need 100% confirmation for that that the user doesn't get's locked out, if the "maxexpired=-1". [and maxage not 0 + maxage week already went away, according to last password update]. the user can only has access via ftp. –  LanceBaynes Nov 12 '11 at 16:47
    
If they can't change their password via FTP, they'll effectively be locked out. –  Mat Nov 12 '11 at 16:49
    
but if the maxexpired is set to -1? –  LanceBaynes Nov 12 '11 at 16:59
show 1 more comment

Since I can't comment yet - @LanceBaynes - The answer by Mat is correct. The user will be locked out, which is not a problem but a security measure to prevent users that haven't used their account for a long time (for example got fired), not to be able to access their accounts by changing passwords if they gained access somehow to a workstation inside the company. The password can be changed anytime by the administrator once the maxexpired time is over.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.