Valid authentication methods are defined in the /etc/security/login.cfg file. The SYSTEM method is always used in addition to the methods listed here on auth1, even if SYSTEM is not specified. The SYSTEM method is defined by the SYSTEM user attribute. If you do not want the user to authenticate using the SYSTEM method, specify NONE for the SYSTEM user attribute.

If this attribute is not specified, the default is NONE, indicating that no secondary authentication check is made. Valid authentication methods are defined in the /etc/security/login.cfg file. If you do not specify a Name parameter, the name of the invoking login program is used.

The password dictionaries are a list of comma-separated absolute path names, evaluated from left to right. All dictionary files and directories must be write-protected from all users except root. The dictionary files are formatted one word per line. The word starts in the first column and terminates with a new-line character. Only 7-bit ASCII words are supported for passwords. If you install text processing on your system, the recommended dictionary file is the /usr/share/dict/words file.

[!]:time-time
        -or-
[!]day[-day][:time-time]
        -or-
[!]date[-date][:time-time]

The day variable must be one digit between 0 and 6 that represents one of the days of the week. A 0 (zero) indicates Sunday and a 6 indicates Saturday.

The time variable is 24-hour military time (1700 is 5:00 p.m.). Leading zeroes are required. For example, you must enter 0800, not 800. The time variable must be four characters in length, and there must be a leading colon (:). An entry consisting of only a time specification applies to every day. The start hour of a time value must be less than the end hour.

The date variable is a four digit string in the form mmdd. mm represents the calendar month and dd represents the day number. For example 0001 represents January 1. dd may be 00 to indicate the entire month, if the entry is not a range, or indicating the first or last day of the month depending on whether it appears as part of the start or end of a range. For example, 0000 indicates the entire month of January. 0600 indicates the entire month of June. 0311-0500 indicates April 11 through the last day of June.

Entries in this list specify times that a user is allowed or denied access to the system. Entries not preceded by an exclamation point (!) allow access and are called ALLOW entries. Entries prefixed with an exclamation point (!) deny access to the system and are called DENY entries. The ! operator applies to only one entry, not the whole restriction list. It must appear at the beginning of an entry.

chsec -f /etc/security/lastlog -s username -a \
unsuccessful_login_count=0

"SYSTEM"       ::= EXPRESSION
EXPRESSION     ::= PRIMITIVE  |
                    "("EXPRESSION")"  |
                     EXPRESSION OPERATOR EXPRESSION
PRIMITIVE      ::= METHOD  |
                    METHOD "["RESULT"]"
RESULT         ::= "SUCCESS" | "FAILURE" | "NOTFOUND" |
                   "UNAVAIL"  | "*"
OPERATOR       ::= "AND" | "OR"
METHOD         ::= "compat" | "files" | "NONE" |
                   [a-z,A-Z,0-9]*

An example of the syntax is:

SYSTEM = "DCE OR DCE[UNAVAIL] AND 
compat"