From:	CSBVAX::MRGATE!RELAY-INFO-VAX@CRVAX.SRI.COM@SMTP  1-SEP-1988 21:24
To:	ARISIA::EVERHART
Subj:	Forcing users to change expired passwords


Received: From KL.SRI.COM by CRVAX.SRI.COM with TCP; Wed, 31 AUG 88 12:57:37 PDT
Received: from CitHex.Caltech.Edu by KL.SRI.COM with TCP; Wed, 31 Aug 88 12:42:01 PDT
Date:    Wed, 31 Aug 88 12:17:15 PDT
From:     carl@CitHex.Caltech.Edu (Carl J Lydick)
Message-Id: <880831121715.330@CitHex.Caltech.Edu>
Subject: Forcing users to change expired passwords
To:       info-vax@CitHex.Caltech.Edu
X-ST-Vmsmail-To: INFOVAX

I noticed recently in a description of improvements in Version  5.0  VMS  that
DEC has changed loginout to force users whose passwords have expired to change
them before the login  finishes.   I  don't  know  whether  this  behavior  is
configurable  or  not,  but  if not, I'd rather have them leave things as they
are, so that the choice as to whether or not to do this is up  to  the  system
manager.   Since DEC's software developers apparently didn't realize that V4.7
(actually, any version  since  the  $GETUAI  system  service  was  introduced)
already  had  this  capability, I'm willing to bet that some of the people who
read INFOVAX didn't either.  Also, since DEC's software developers  seemed  to
think   this   was   important   enough  to  implement  it,  I'm  sending  the
implementation I've been using on CITHEX.  In order to  make  this  work,  you
have to:
    1)  Compile and link the C program that follows.
    2)  Issue the command "$ MCR AUTHORIZE MODIFY  */FLAG=DISCTLY"  with  your
        default  directory  set  to  SYS$SYSTEM  (or with SYSUAF defined to be
        SYS$SYSTEM:SYSUAF); and
    3)  Add the  DCL  stuff  that  follows  to  SYS$SYLOGIN:.COM,  fixing  the
        reference  on  line  3  to  refer to the appropriate directory on your
        system.
Hope somebody finds this useful (and sorry I didn't think  ofposting it to the
net a long time ago).
################################################################################
$!Add this to SYS$SYLOGIN:.COM (after changing references to HEP$UTIL on
$	bel[0,8] = 7
$! Fix the following line to refer your sites local utility directory
$ loop:	run hep$util:check_pwd_expired
$	if $status .eq. 1 then goto next
$	write sys$output f$fao("!AS!AS!/", bel, -
		"Your password has expired.  You must set it now")
$	if f$getjpi("","MODE") .nes. "INTERACTIVE" then logout/full
$	define/user sys$input sys$command
$	set password                                              
$	goto loop
$ next:	if .not. f$environment("CAPTIVE") then set control=y
################################################################################
/*************************** CHECK_PWD_EXP.C BEGINS ***************************/
#include "$uaidef.h"
#include jpidef
#include descrip

main()
{	char rslbuf[12];
	$DESCRIPTOR(usrnam, rslbuf);
	long status;
	short rsl;
	struct flags flags;
	struct ITEM_LIST_3
	{	short buflen;	/* Size of result buffer		*/
		short itmcod;	/* Item request code			*/
		char  *bufadr;	/* Address of result buffer		*/
		short *rsladr;	/* Address of word for length of result	*/
	} itmlst[] = 
	{	12,JPI$_USERNAME,rslbuf,&rsl,0,0,0,0,
		4 ,UAI$_FLAGS,   &flags,   0,0,0,0,0
	};

	if (((status = SYS$GETJPIW(0, 0, 0, itmlst, 0, 0, 0)) & 7) != 1)
	{	puts("Unable to get process USERNAME information");
		exit(status);
	}
	usrnam.dsc$w_length = rsl;
	if (((status = SYS$GETUAI(0, 0, &usrnam, itmlst+2, 0, 0, 0)) & 7) != 1)
	{	puts("Unable to get information");
		exit(status);
	}
	return(2 * flags.uai$v_pwd_expired + 1);
}
/**************************** CHECK_PWD_EXP.C ENDS ****************************/

/****************************** $UAIDEF.H BEGINS ******************************/
#ifndef $UAIDEF_H
#define $UAIDEF_H
 
/*** MODULE $UAIDEF ***/
/*+                                                                          */
/*                                                                           */
/* Get User Authorization Information Data Identifier Definitions            */
/*                                                                           */
/* **** NOTE ****                                                            */
/*                                                                           */
/*        New items must always be added to the END of each item list        */
/*        so that users will not have to relink.                             */
/*-                                                                          */
#define UAI$_RTYPE 1    /* UAF record type                                   */
#define UAI$_VERSION 2  /* UAF format version                                */
#define UAI$_USRDATOFF 3        /* offset of counted string of user data     */
#define UAI$_USERNAME 4 /* username                                          */
#define UAI$_USERNAME_TAG 5     /* tag to differentiate records              */
#define UAI$_UIC 6      /* user ID code                                      */
#define UAI$_MEM 7      /* member subfield                                   */
#define UAI$_GRP 8      /* group subfield                                    */
#define UAI$_SUB_ID 9   /* user sub-identifier                               */
#define UAI$_PARENT_ID 10       /* identifier of owner of this account       */
#define UAI$_ACCOUNT 11 /* account name                                      */
#define UAI$_OWNER 12   /* owner's name                                      */
#define UAI$_DEFDEV 13  /* default device                                    */
#define UAI$_DEFDIR 14  /* default directory                                 */
#define UAI$_LGICMD 15  /* login command file                                */
#define UAI$_DEFCLI 16  /* default command interpreter                       */
#define UAI$_CLITABLES 17       /* user CLI tables                           */
#define UAI$_PWD 18     /* hashed password                                   */
#define UAI$_PWD2 19    /* second password                                   */
#define UAI$_LOGFAILS 20        /* count of login failures                   */
#define UAI$_SALT 21    /* random password salt                              */
#define UAI$_ENCRYPT 22 /* encryption algorithm                              */
#define UAI$_ENCRYPT2 23        /* encryption algorithm for 2nd pwd          */
#define UAI$_PWD_LENGTH 24      /* minimum password length                   */
#define UAI$_EXPIRATION 25      /* expiration date for account               */
#define UAI$_PWD_LIFETIME 26    /* password lifetime                         */
#define UAI$_PWD_DATE 27        /* date of password change                   */
#define UAI$_PWD2_DATE 28       /* date of 2nd password change               */
#define UAI$_LASTLOGIN_I 29     /* date of last interactive login            */
#define UAI$_LASTLOGIN_N 30     /* date of last non-interactive login        */
#define UAI$_PRIV 31    /* process privilege vector                          */
#define UAI$_DEF_PRIV 32        /* default process privileges                */
#define UAI$_MIN_CLASS 33       /* minimum security class                    */
#define UAI$_MAX_CLASS 34       /* maximum security class                    */
#define UAI$_FLAGS 35   /* user flags longword                               */
#define UAI$_NETWORK_ACCESS_P 36        /* hourly network access, primary    */
#define UAI$_NETWORK_ACCESS_S 37        /* hourly network access, secondary  */
#define UAI$_BATCH_ACCESS_P 38  /* hourly batch access, primary              */
#define UAI$_BATCH_ACCESS_S 39  /* hourly batch access, secondary            */
#define UAI$_LOCAL_ACCESS_P 40  /* hourly local access, primary              */
#define UAI$_LOCAL_ACCESS_S 41  /* hourly local access, secondary            */
#define UAI$_DIALUP_ACCESS_P 42 /* hourly dialup access, primary             */
#define UAI$_DIALUP_ACCESS_S 43 /* hourly dialup access, secondary           */
#define UAI$_REMOTE_ACCESS_P 44 /* hourly remote access, primary             */
#define UAI$_REMOTE_ACCESS_S 45 /* hourly remote access, secondary           */
#define UAI$_PRIMEDAYS 46       /* bits representing primary days            */
#define UAI$_PRI 47     /* base process priority                             */
#define UAI$_QUEPRI 48  /* maximum job queuing priority                      */
#define UAI$_MAXJOBS 49 /* maximum jobs for UIC allowed                      */
#define UAI$_MAXACCTJOBS 50     /* maximum jobs for account allowed          */
#define UAI$_MAXDETACH 51       /* maximum detached processes for UIC        */
#define UAI$_PRCCNT 52  /* subprocess creation limit                         */
#define UAI$_BIOLM 53   /* buffered I/O limit                                */
#define UAI$_DIOLM 54   /* direct I/O limit                                  */
#define UAI$_TQCNT 55   /* timer queue entry limit                           */
#define UAI$_ASTLM 56   /* AST queue limit                                   */
#define UAI$_ENQLM 57   /* enqueue limit                                     */
#define UAI$_FILLM 58   /* open file limit                                   */
#define UAI$_SHRFILLM 59        /* shared file limit                         */
#define UAI$_WSQUOTA 60 /* working set size quota                            */
#define UAI$_DFWSCNT 61 /* default working set size                          */
#define UAI$_WSEXTENT 62        /* working set size limit                    */
#define UAI$_PGFLQUOTA 63       /* page file quota                           */
#define UAI$_CPUTIM 64  /* CPU time quota                                    */
#define UAI$_BYTLM 65   /* buffered I/O byte count limit                     */
#define UAI$_PBYTLM 66  /* paged buffer I/O byte count limit                 */
#define UAI$_JTQUOTA 67 /* job-wide logical name table creation quota        */
#define UAI$_PROXY_LIM 68       /* number of proxies user can grant          */
#define UAI$_PROXIES 69 /* number of proxies granted                         */
#define UAI$_ACCOUNT_LIM 70     /* number of sub-accounts allowed            */
#define UAI$_ACCOUNTS 71        /* number of sub-accounts in use             */
/* ADD ITEM-CODES BEFORE THIS COMMENT                                        */
/* Define the various encryption codes, returned by the encryption algorithm */
/* item.                                                                     */
#define UAI$C_AD_II 0   /* AUTODIN-II 32 bit crc code                        */
#define UAI$C_PURDY 1   /* Purdy polynomial over salted input                */
#define UAI$C_PURDY_V 2 /* Purdy polynomial + variable length username       */
/* Define the flags for the user flags longword.                             */
#define UAI$M_DISCTLY 0x00000001
#define UAI$M_DEFCLI 0x00000002
#define UAI$M_LOCKPWD 0x00000004
#define UAI$M_CAPTIVE 0x00000008
#define UAI$M_DISACNT 0x00000010
#define UAI$M_DISWELCOM 0x00000020
#define UAI$M_DISMAIL 0x00000040
#define UAI$M_NOMAIL 0x00000080
#define UAI$M_GENPWD 0x00000100
#define UAI$M_PWD_EXPIRED 0x00000200
#define UAI$M_PWD2_EXPIRED 0x00000400
#define UAI$M_AUDIT 0x00000800
#define UAI$M_DISREPORT 0x00001000
#define UAI$M_DISRECONNECT 0x00002000
#define UAI$M_AUTOLOGIN 0x00004000
struct flags {  /* user flags longword                                       */
    unsigned uai$v_disctly : 1; /* no user control-y                         */
    unsigned uai$v_defcli : 1;  /* only allow user default CLI               */
    unsigned uai$v_lockpwd : 1; /* disable SET PASSWORD command              */
    unsigned uai$v_captive : 1; /* captive account (no overrides)            */
    unsigned uai$v_disacnt : 1; /* no interactive login                      */
    unsigned uai$v_diswelcom : 1;       /* skip welcome message              */
    unsigned uai$v_dismail : 1; /* skip new mail message                     */
    unsigned uai$v_nomail : 1;  /* disable mail delivery                     */
    unsigned uai$v_genpwd : 1;  /* passwords must be generated               */
    unsigned uai$v_pwd_expired : 1;     /* password has expired              */
    unsigned uai$v_pwd2_expired : 1;    /* 2nd password has expired          */
    unsigned uai$v_audit : 1;   /* audit all actions                         */
    unsigned uai$v_disreport : 1;       /* skip last login messages          */
    unsigned uai$v_disreconnect : 1;    /* inhibit reconnections             */
    unsigned uai$v_autologin : 1;       /* auto-login only                   */
    unsigned uai$v_fill_6 : 1;
} ;
/* Define the flags representing primary days.                               */
struct primedays {      /* bits representing primary days                    */
    unsigned uai$v_monday : 1;  /* bit clear means this is a primary day     */
    unsigned uai$v_tuesday : 1; /* bit set means this is an off day          */
    unsigned uai$v_wednesday : 1;
    unsigned uai$v_thursday : 1;
    unsigned uai$v_friday : 1;
    unsigned uai$v_saturday : 1;
    unsigned uai$v_sunday : 1;
    unsigned uai$v_fill_7 : 1;
} ;
#endif
/******************************* $UAIDEF.H ENDS *******************************/

