Password control quiestion Data Whse,- was Long-runnin...

In <3v3i9q$cv0@hecate.umd.edu> mnorouzi@delphi.umd.edu (Maryam Norouzi) writes: >We are developing a PowerBuilder application which is accessing >INFORMIX-OnLine 7.1 on a Pyramid. Every user is going to have a unique UNIX >login ID to access the database. They use the same login to log on to >the application and access INFORMIX database. The problem is that we >need to change these passwords every 90 days. We need suggestions on >how to change these passwords so that the UNIX passwords will be >updated also making sure that it is transparent to the user. >Does INFORMIX has this ability? ANY suggestions would be greatly >appreciated. Using the same passwords for unix and your database applications is not a good procedure. I feel you will be safer using different passowrds and not changing them every 90 days. Also educate users and make them use numbers. If you don't like a user's password make them change it. Supervise them when they choose the password. Bad security is a people problem as much as it is a computer problem. If you must follow this procedure, how about a card reader at each workstation. Just distribute new tokens every 90 days. Also read the man for password. There is an ageing feature. I don't like it when programs fiddle with the password file. It makes for a great back door to hack in. Think this thing through and if your boss is making you do it, you may need to reeducate on security issues. -- Hal Cooper - hal@teleport.com| The opinions and statements contained in this MIS Manager | posting are the sole responsibility of the Paper Products Marketing | author and have not in any way been reviewed _____________________________| or approved by my employer.