********************************* PASS *************************************** This is a revision to Pass, which was released on a previous DECUS symposium tape. This revision has the following changes; - Pass now stores the entire salt. The previous version only stored half the salt. This would only be a problem if a user were deleted and re-added, and half of the salt longword was the same (chances of this are probably 1 in several million). Use Fixit.com to convert your MASTEROLD.DAT file to the enlarged salt field. - Pass no longer uses the DEC login validation routines to read the UAF, thanks to the GETUAI system service. Now, can they please incorporate wildcard lookup in GETUAI so I can get rid of GETUSERS.COM?? - Pass no longer requires the STDEDC.H include file. - Daily.com has been renamed Pass.com - The working directory is assumed to be SYS$SYSROOT:[SYSMGR.PASS]. Future plans include incorporating wildcard GETUAI (when DEC mods it) as well as callable mail and SETUAI (to expire their password). ******************************************************************************** Pass is a program that prevents users from re-using passwords. This will keep users from setting their password and then setting it back to the original in order to thwart the UAF password timeout. Pass reads a file containing the usernames of all users on the system, and finds their current password in its encrypted form. It then checks a password history file to see if they have re-used a password. The history has a 20 password memory. Since Pass only runs once each day (at midnight), the user would have to change his password once a day for 20 days before he would be allowed to re-use one. When Pass finds one that has been re-used, it writes an entry in output.tmp, which is then used to alert the system manager via mail. The user will also arrive the next morning to find that their password has been timed out, and they will have to change it again! (this can be disabled in pass.com) If a username is deleted and then re-added, their salt (used in encrypting their password) will probably be different. If the salt changes for a given user, pass will zero out their password history to avoid errors. This command procedure will run in less than one minute on an idle 11/780 with about 90 usercodes. For initially setting up the masterold file, type "@first". This will initialize some stuff, and then it will submit pass.com to sys$batch at priority 4 with /after=tomorrow. Pass.com will re-submit itself each day and will produce and purge (but not print) a log file.