unixdev.net


Switch to SpeakEasy.net DSL

The Modular Manual Browser

Home Page
Manual: (HP-UX-11.11)
Page:
Section:
Apropos / Subsearch:
optional field



 account(1m)		  Open Software Foundation		 account(1m)




 NAME
      account - A dcecp object that manages an account in the DCE Security
      Service

 SYNOPSIS
      account catalog [cell_name] [-simplename]

      account create account_name_list
      -mypwd password
      -password password
      -group group_name
      -organization organization_name
      [-attribute attribute_list | -attribute value]

      account delete account_name_list

      account generate account_name

      account help [operation | -verbose]

      account modify account_name_list
      [-mypwd password]
      {-change attribute_list | -attribute value}

      account operations

      account show account_name_list [-policies | -all]


 ARGUMENTS
      account_name
		The name of a single account to act on. See
		account_name_list for the name format.

      account_name_list
		A list of one or more names of accounts to act on. Note that
		accounts are identified by principal names, so when you
		create an account you supply a principal name for the
		account name.

		Supply the names as follows:


		  +  Fully qualified account names in the form
		     /.../cell_name/account_name, /.:/account_name, or
		     account_name@cell_name.

		  +  Cell-relative account names in the form account_name.
		     These names refer to an account in the cell identified
		     in the _s(sec) convenience variable, or if the _s(sec)
		     convenience variable is not set, in the local host's



 Hewlett-Packard Company	    - 1 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




		     default cell.


		Do not mix fully qualified names and cell-relative names in
		a list. In addition, do not use the names of registry
		database objects that contain account information; in other
		words, do not use account names that begin with
		/.:/sec/account/.

      cell_name The name of a specific cell (or /.: for the local cell) in
		which to catalog accounts.

      operation The name of the account operation for which to display help
		information.


 DESCRIPTION
      The account object represents registry accounts.	Although an account
      is associated with one principal, one group, and one organization, it
      is identified by the principal's primary name.  Alias names are
      differentiated for principals, so one principal can have multiple
      accounts under different alias names.

      When this command executes, it attempts to bind to the registry server
      identified in the _s(sec) variable. If that server cannot process the
      request or if the _s(sec) variable is not set, the command binds to
      either an available slave server or the master registry server,
      depending on the operation. Upon completion, the command sets the
      _b(sec) convenience variable to the name of the registry server it
      bound to.

 ATTRIBUTES
      The account object supports the following two kinds of attributes:


	+  Account attributes may or may not have default values.  They
	   assume a default value or a value set by administrators.

	+  Policy attributes regulate such things as account and password
	   lifetimes for all accounts associated with a particular registry.
	   Policy attributes have registry wide default values.	 They always
	   assume the most restrictive value whether it is the registry wide
	   default value or a value set for an individual account.


    Account Attributes
      acctvalid {yes | no}
		A flag set to determine account validity.  Its value is
		either yes or no.  An account with an acctvalid attribute
		set to no is invalid and cannot be logged in to.  The
		default is yes.



 Hewlett-Packard Company	    - 2 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      client {yes | no}
		A flag set to indicate whether the account is for a
		principal that can act as a client.  Its value is either yes
		or no.	If you set this flag to yes, the principal is able
		to log in to the account and acquire tickets for
		authentication.	 The default is yes.

      created creators_name ISO_timestamp
		A list of two items.  The first is the principal name of the
		creator of the account, the second is an ISO timestamp
		showing the time of creation.  This attribute is set by the
		system at the time of account creation and cannot be
		specified or modified.

      description string
		A text string (limited to the Portable Character Set)
		typically used to describe the use of the account.  The
		default is the empty string ("").

      dupkey {yes | no}
		A flag set to determine whether tickets issued to the
		account's principal can have duplicate keys.  Its value is
		either yes or no.  The default is no.

		In DCE this attribute is currently only advisory.  However,
		Kerberos clients and servers make use of it when they
		interact with a DCE Security server.

      expdate  ISO_timestamp
		The date on which the account expires.	To renew the
		account, change the date in this field.	 To specify the
		time, use an ISO-compliant time format such as CCYY-MM-DD-
		hh:mm:ss or the string none. The default is none.

      forwardabletkt {yes | no}
		A flag set to determine whether a new ticket-granting ticket
		with a network address that differs from the present
		ticket-granting ticket's network address can be issued to
		the account's principal.  The proxiabletkt attribute
		performs the same function for service tickets.	 Its value
		is either yes or no.  The default is yes.

		In DCE this attribute is currently only advisory.  However,
		Kerberos clients and servers make use of it when they
		interact with a DCE Security server.

      goodsince ISO_timestamp
		The date and time the account was last known to be in an
		uncompromised state.  Any tickets granted before this date
		are invalid.  The value is an ISO timestamp.  When the
		account is initially created, the goodsince date is set to



 Hewlett-Packard Company	    - 3 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




		the current date. Control over this date is especially
		useful if you know that an account's password was
		compromised.  Changing the password can prevent the
		unauthorized principal from accessing the system again using
		that password, but the changed password does not prevent the
		principal from accessing the system components for which
		tickets were obtained fraudulently before the password was
		changed.  To eliminate the principal's access to the system,
		the tickets must be cancelled.

		The default is the time the account was created.

      group group_name
		The name of the group associated with the account.  The
		value is a single group name of an existing group in the
		registry.  This attribute must be specified for the account
		create command; it does not have a default value.

		If a group is deleted from the registry, all accounts
		associated with the group are also deleted.

      home directory_name
		The file system directory in which the principal is placed
		at login. The default is the / directory.

      lastchange principal_name ISO_timestamp
		A list of two items.  The first is the principal name of the
		last modifier of the account; the second is an ISO timestamp
		showing the time of the last modification.  This attribute
		is set by the system whenever the account is modified; it
		cannot be set or modified directly.  The initial value
		consists of the principal name of the creator of the account
		and the time the account was created.

      organization organization_name
		The name of the organization associated with the account.
		The value is a single organization name of an existing
		organization in the registry.  This attribute must be
		specified for the account create command; it does not have a
		default value.

		If an organization is deleted from the registry, all
		accounts associated with the organization are deleted also.

      password password
		The password of the account. This attribute must be
		specified for the account create command; there is no
		default value. This attribute is not returned by an account
		show command.





 Hewlett-Packard Company	    - 4 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      postdatedtkt {yes | no}
		A flag set to determine if tickets with a start time some
		time in the future can be issued to the account's principal.
		Its value is either yes or no.	The default is no.

		In DCE, this attribute is currently only advisory.  However,
		Kerberos clients and servers make use of it when they
		interact with a DCE Security server.

      proxiabletkt {yes | no}
		A flag set to determine whether a new ticket with a
		different network address than the present ticket can be
		issued to the account's principal.  The forwardabletkt
		attribute performs the same function for ticket-granting
		tickets.  Its value is either yes or no.  The default is no.

		In DCE, this attribute is currently only advisory.  However,
		Kerberos clients and servers make use of it when they
		interact with a DCE Security server.

      pwdvalid {yes | no}
		A flag set to determine whether the current password is
		valid.	If this flag is set to no, the next time a principal
		logs in to the account, the system prompts the principal to
		change the password.  (Note that this flag is separate from
		the pwdexpdate policy, which sets time limits on password
		validity.)  Its value is either yes or no.  The default is
		yes.

      renewabletkt {yes | no}
		A flag set to determine if the ticket-granting ticket issued
		to the account's principal can be renewed.  If this flag is
		set to yes, the authentication service renews the ticket-
		granting ticket if its lifetime is valid.  Its value is
		either yes or no.  The default is yes.

		In DCE this attribute is currently only advisory.  However,
		Kerberos clients and servers make use of it when they
		interact with a DCE Security server.

      server {yes | no}
		A flag set to indicate whether the account is for a
		principal that can act as a server.  Its value is either yes
		or no.	This flag should be yes for any server that engages
		in authenticated communications. The default is yes.

      shell path_to_shell
		The path of the shell that is executed when a principal logs
		in. The legal value is any shell supported by the home cell.
		The default value is the empty string ("").




 Hewlett-Packard Company	    - 5 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      stdtgtauth {yes | no}
		A flag set to determine whether service tickets issued to
		the account's principal use the standard DCE ticket-granting
		ticket authentication mechanism.  Its value is either yes or
		no.  The default is yes.


    Policy Attributes
      maxtktlife relative_time
		The maximum amount of time that a ticket can be valid.	To
		specify the time, use the Distributed Time Service (DTS)
		relative time format ([-]DD-hh:mm:ss). When a client
		requests a ticket to a server, the lifetime granted to the
		ticket takes into account the maxtktlife set for both the
		server and the client.	In other words, the lifetime cannot
		exceed the shorter of the server's or client's maxtktlife.
		If you do not specify a maxtktlife for an account, the
		maxtktlife defined as registry authorization policy is used.

      maxtktrenew relative_time
		The amount of time before a principal's ticket-granting
		ticket expires and that principal must log in to the system
		again to reauthenticate and obtain another ticket-granting
		ticket.	 To specify the time, use the DTS relative time
		format ([-]DD-hh:mm:ss).  The lifetime of the principal's
		service tickets can never exceed the lifetime of the
		principal's ticket-granting ticket.  The shorter you make
		maxtktrenew, the greater the security of the system.
		However, since principals must log in again to renew their
		ticket-granting ticket, the time specified needs to balance
		user convenience against the level of security required. If
		you do not specify this for an account, the maxtktrenew
		lifetime defined as registry authorization policy is used.

		This feature is not currently used by DCE; any use of this
		option is unsupported at the present time.


      See the OSF DCE Administration Guide for more information about
      account attributes.

 OPERATIONS
    account catalog
      Returns a list of the names of all accounts in the registry. The
      syntax is as follows:

      account catalog [cell_name] [-simplename]


      Options




 Hewlett-Packard Company	    - 6 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      -simplename
		Returns a list of account names in the registry without
		prepending the name of the cell.


      The catalog operation returns a list of the names of all accounts in
      the local registry database. Use the cell_name argument to return a
      list of accounts in another cell's registry. By default, fully
      qualified names are returned in the form cell_name/account_name. Use
      the -simplename option to return the names without the cell name in
      the form account_name.

      Privileges Required

      You must have r (read) permission to the principal named in the
      account.

      Examples

      dcecp> account catalog -simplename
      nobody
      root
      daemon
      uucp
      bin
      dce-ptgt
      dce-rgy
      krbtgt/goodco.com
      cell_admin
      hosts/pmin17/self
      hosts/pmin17/cds-server
      hosts/pmin17/gda
      ward
      dcecp>

      dcecp> account catalog
      /.../goodco.com/nobody
      /.../goodco.com/root
      /.../goodco.com/daemon
      /.../goodco.com/uucp
      /.../goodco.com/bin
      /.../goodco.com/dce-ptgt
      /.../goodco.com/dce-rgy
      /.../goodco.com/krbtgt/goodco.com
      /.../goodco.com/cell_admin
      /.../goodco.com/hosts/pmin17/self
      /.../goodco.com/hosts/pmin17/cds-server
      /.../goodco.com/hosts/pmin17/gda
      /.../goodco.com/ward
      dcecp>




 Hewlett-Packard Company	    - 7 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




    account create
      Creates a new account in the registry database.  The syntax is as
      follows:

      account create account_name_list
      -mypwd password
      -password password
      -group group_name
      -organization organization_name
      [-attribute attribute_list | -attribute value]


      Options

      -attribute value
		As an alternative to using the -attribute option with an
		attribute list, you can specify individual attribute options
		by prepending a hyphen (-) to any attributes listed in the
		ATTRIBUTES section of this reference page.

      -attribute attribute_list
		Allows you to specify attributes by using an attribute list
		rather than individual attribute options. The format of an
		attribute list is as follows:

		{{attribute value}...{attribute value}}


      -group group_name
		The name of the group to associate with the account.  See
		Account Attributes for the format of a group name.

      -mypwd password
		Your privileged password. You must enter your privileged
		password to create an account.	This check prevents a
		malicious user from using an existing privileged session to
		create unauthorized accounts. You must specify this option
		on the command line; it cannot be supplied in a script.

      -organization organization_name
		The name of the organization to associate with the account.
		See Account Attributes for the format of an organization
		name.

      -password password
		The account password.  See Account Attributes for the format
		of a password.


      The create operation creates a new account.  The account_name_list
      argument is a list of names of principals for which the accounts are



 Hewlett-Packard Company	    - 8 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      to be created.  This operation returns an empty string on success.

      You must specify the group, organization, password, and mypwd
      attributes on the command line (either in an attribute list or with
      attribute options). The attributes specified are applied to all of the
      accounts created.

      To protect the account password being entered, the account create
      command can be entered only from within dcecp. You cannot enter this
      command from the operating system prompt by using dcecp with the -c
      option.

      Before you can create a new account, you must create a principal by
      using the principal create command.  Then you must add the principal
      to an existing group and organization using the group add and
      organization add commands.

      Privileges Required

      You must have the following permissions:


	+  gmau (groups, mgmt_info, auth_info, and user_info) permissions to
	   the principal named in the account

	+  rtM (read, test, Member_list) permissions to the organization
	   named in the account

	+  tM (test, Member_list) permissions to the group named in the
	   account

	+  r (read) permission on the registry policy object.


      Examples

      dcecp> principal create John_Hunter
      dcecp>

      dcecp> group add users -member John_Hunter
      dcecp>

      dcecp> organization add users -member John_Hunter
      dcecp>

      dcecp> account create John_Hunter -group users -organization users \
      > -mypwd my.secret.password -password change.me
      dcecp>

      dcecp> account create jimbo@gumby_cell -group none -organization none \
      > -mypwd my.secret.password -password change.me



 Hewlett-Packard Company	    - 9 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      dcecp>


    account delete
      Deletes existing accounts from the registry.  The syntax is as
      follows:

      account delete account_name_list


      The delete operation deletes existing accounts from the registry. The
      argument is a list of names of accounts to be deleted.  If the
      accounts do not exist, an error is generated.  This operation returns
      an empty string on success.

      Privileges Required

      You must have rmau (read, mgmt_info, auth_info, user_info) permissions
      for the principal named in the account.

      Examples

      dcecp> account delete john_hunter
      dcecp>


    account generate
      Randomly generates a password for a named account. The syntax is as
      follows:

      account generate account_name


      To run the account generate command, the pwd_strength server must be
      running, the principal identified by account_name must exist, and the
      pwd_mgmt_binding and pwd_val_type Extended Registry Attributes must be
      attached to that principal.  Otherwise, an error is generated.  The
      command returns a randomly generated password on success.

      See the OSF DCE Administration Guide for more information about the
      pwd_strength server.

      After the password is generated, run the account create command to
      establish the account.  Supply the randomly generated password as the
      account's password (using the -password option).

      Privileges Required

      You must have the gmau  (groups, mgmt_info, auth_info, and user_info)
      permissions for the principal named in the account.




 Hewlett-Packard Company	   - 10 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      Examples

      dcecp> account generate john_hunter
      7xZ34yF
      dcecp>


    account help
      Returns help information about the account object and its operations.
      The syntax is as follows:

      account help [operation | -verbose]


      Options


      -verbose	Displays information about the account object.


      Used without an argument or option, the account help command returns
      brief information about each account operation. The optional operation
      argument is the name of an operation about which you want detailed
      information. Alternatively, you can use the -verbose option for more
      detailed information about the account object itself.

      Privileges Required

      No special privileges are needed to use the account help command.

      Examples

      dcecp> account help
      catalog		  Returns the names of all accounts in the registry.
      create		  Creates an account in the registry.
      delete		  Deletes an account from the registry.
      generate		  Generates a random password for an account in the registry.
      modify		  Modifies an account in the registry.
      show		  Returns the attributes of an account.
      help		  Prints a summary of command-line options.
      operations	  Returns a list of the valid operations for this command.
      dcecp>


    account modify
      Changes attributes and policies of existing accounts.  The syntax is
      as follows:

      account modify account_name_list
      [ -mypwd password]
      {-change attribute_list | -attribute value}



 Hewlett-Packard Company	   - 11 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      Options


      -attribute value
		As an alternative to using the -change option with an
		attribute list, you can specify individual attribute options
		by prepending a hyphen (-) to any attributes listed in the
		ATTRIBUTES section of this reference page.

      -change attribute_list
		Allows you to modify attributes by using an attribute list
		rather than individual attribute options.  The format of an
		attribute list is as follows:

		{{attribute value}...{attribute value}}



      -mypwd password
		Lets you supply your privileged password when changing
		policy or administration data.	You must enter your
		privileged password to change an account password;
		otherwise, the -mypwd option is optional. This check
		prevents a malicious user from using an existing privileged
		session to modify passwords of existing accounts.


      The modify operation modifies account attributes. The -add and -remove
      options are not supported because the attributes created when the
      account is created cannot be deleted, nor can additional attributes be
      added. To change an account attribute, supply the new value in an
      attribute list or as an individual attribute option.  This operation
      returns an empty string on success.

      When an account's password is being modified, in order to protect the
      password being entered, you can execute the account modify command
      only from within the dcecp program; you cannot execute it from the
      operating system prompt using dcecp with the -c option.

      Privileges Required

      You must have rm (read, mgmt_info) permissions for the principal named
      in the account.

      Examples

      The following example changes the account's expiration date and login
      shell by specifying the expdate and shell attributes as individual
      attribute options.

      dcecp>&gt&gt> account modify John_Hunter -expdate 1998-03-19-00:00:00.000 -shell /bin/csh



 Hewlett-Packard Company	   - 12 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      dcecp>&gt&gt>

      dcecp>&gt&gt> account show John_Hunter
      {acctvalid yes}
      {client yes}
      {created /.../my_cell.goodco.com/cell_admin 1994-06-15-18:31:08.000+00:00I-----}
      {description {}}
      {dupkey no}
      {expdate 1998-03-19-00:00:00.000+00:00I-----}
      {forwardabletkt yes}
      {goodsince 1994-06-15-18:31:05.000+00:00I-----}
      {group users}
      {home /}
      {lastchange /.../my_cell.goodco.com/cell_admin 1994-06-16-12:21:07.000+00:00I-----}
      {name John_Hunter}
      {organization users}
      {postdatedtkt no}
      {proxiabletkt no}
      {pwdvalid yes}
      {renewabletkt yes}
      {server yes}
      {shell /bin/csh}
      {stdtgtauth yes}
      dcecp>&gt&gt>


    account operations
      Returns a list of the operations supported by the account object. The
      syntax is as follows:

      account operations


      The list of available operations is in alphabetical order except for
      help and operations, which are listed last.

      Privileges Required

      No special privileges are needed to use the account operations
      command.

      Examples

      dcecp> account operations
      catalog create delete generate modify show help operations
      dcecp>


    account show
      Returns attribute information for the specified accounts. The syntax
      is as follows:



 Hewlett-Packard Company	   - 13 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      account show account_name_list [-policies | -all]


      Options


      -policies Returns only account polices.

      -all	Returns account attributes followed by account policies.


      The show operation returns an attribute list describing the specified
      accounts.	 The argument is a list of names of accounts to be operated
      on.  If more than one account is given, the attributes and policies
      are concatenated and a blank line inserted between accounts.  The
      -policies option lets you return the policies of the account instead
      of the attributes.  The -all option returns the attributes followed by
      the policies.

      Attributes and policies are returned in lexical order.  If the account
      has no policies, the operation displays the string nopolicy.

      The policies that are actually in effect can be different from the
      account policies due to conflicts with registry wide policies. If this
      is the case, the show operation alters the attribute structure on
      output to include an effective tag and the effective value, much in
      the same way organization show does.

      Privileges Required

      You must have r (read) permission to the principal named in the
      account.

      Examples

      dcecp> account show John_Hunter
      {acctvalid yes}
      {client yes}
      {created /.../my_cell.goodco.com/cell_admin 1994-06-15-18:31:08.000+00:00I-----}
      {description {}}
      {dupkey no}
      {expdate 1998-03-19-00:00:00.000+00:00I-----}
      {forwardabletkt yes}
      {goodsince 1994-06-15-18:31:05.000+00:00I-----}
      {group users}
      {home /}
      {lastchange /.../my_cell.goodco.com/cell_admin 1994-06-16-12:21:07.000+00:00I-----}
      {name John_Hunter}
      {organization users}
      {postdatedtkt no}
      {proxiabletkt no}



 Hewlett-Packard Company	   - 14 -	      OSF DCE 1.1/HP DCE 1.8






 account(1m)		  Open Software Foundation		 account(1m)




      {pwdvalid yes}
      {renewabletkt yes}
      {server yes}
      {shell {}}
      {stdtgtauth yes}
      dcecp>


 RELATED INFORMATION
      Commands:	   dcecp(1m),	 dcecp_group(1m),    dcecp_organization(1m),
      dcecp_principal(1m), dcecp_registry(1m).











































 Hewlett-Packard Company	   - 15 -	      OSF DCE 1.1/HP DCE 1.8