最近公司的HP服务器的密码相应的提示已到期，提示更改密码，在修改密码的过程中，遇到了一些问题，现记录如下：

1. 密码错误
   输入的密码错误的时候，系统会提示如下：
   *******************************************************
   -------------------ERROR PASSWORD----------------------
   *******************************************************
   Password authentication failed.
   Please verify that the username and password are correct.

2. 输入错误密码超过安全策略值
    输入错误密码输入超过Unsuccessful Login Tries Allowed次，然后输入了正确的密码时：DEFAULT (3)，提示如下错误：
   *******************************************************
   Warning!!!Any Access Without Permission Is Forbidden!!!
   *******************************************************
   Account is disabled - see Account Administrator

3. 密码过期
   帐户已过期，请修改密码

4. 密码过期，但是超过了修改过期密码的生命周期
   密码过期后，由于没有及时的登陆修改，造成了超过了修改密码的生命周期，会提示如下错误，并且不允许再次修改。
   *******************************************************
   Warning!!!Any Access Without Permission Is Forbidden!!!
   *******************************************************
   CPF-AP2[/]passwd xunjian
   Changing password for xunjian
   Last successful password change for xunjian: Tue Jul  7 10:39:17 2009
   Last unsuccessful password change for xunjian: NEVER
   Password cannot be changed.  Reason: password lifetime has passed.

解决办法：

方法一：root@test2[/]# ./usr/lbin/modprpw -k xunjian

方法二：sam -> Actions -> MODIFY Security Policies -> General USER Account Policies -> Unsuccessful Login Tries Allowed:[DEFAULT (3)]修改成0

参考：
root@test1[/usr/lbin]# man modprpw
  NAME
      modprpw - modify protected password database

 SYNOPSIS
      modprpw [-E|-V] [-l]

      modprpw [-x] [-l]  username

      modprpw [-A|-e|-v|-k] [-m field=value,... ] [-l]  username

 DESCRIPTION
      modprpw updates the user's protected password database settings.  This
      command is available only to the superuser in a trusted system.

      Usage other than via SAM, and/or modifications out of sync with
      /etc/passwd may result in serious database corruption and the
      inability to access the system.

      All updated values may be verified using the getprpw command.  See
      getprpw(1M).

      modprpw uses the /etc/nsswitch.conf configuration file default if -l
      is not specified.  See nsswitch.conf(4).

    Options
      modprpw sets user's parameters as defined by the options specified.
      At least one option is required.  If a field is not specified in the
      option then its value remains unchanged in the database.

      modprpw recognizes the following options:

      -A   To add a new user entry and to return a random password which the
           new user must use to login the first time.  This entry has to be
           created with the given username and the -m uid=value.

           Error is returned if the user already exists.

           May be combined with the -l option.

           Unlike the useradd command, it does not create nor populate the
           home directory, and it does not update /etc/passwd.

      -E   This option is specified WITHOUT a user name to expire all user's
           passwords.  It goes through the protected password database and
           zeroes the successful change time of all users.  The result is
           all users will need to enter a new password at their next login.

           May be combined with the -l option.

      -e   This option is specified with a user name to expire the specified
           user's password. It zeroes the successful change time.

      -k   To unlock/enable a user's account that has become disabled,
           except when the lock is due to a missing password or * password.

           May be combined with the -l and/or -m options.

      -l   This option modifies data for a local user, username.  This
           option must be specified with other options.

      -m   field=value,...
           Modify the database field to the specified value and/or resets
           locks.  Valid with one of the following options: -A, -e, -v, -k,
           or -l.

      -V   This option is specified WITHOUT a user name to
           "validate/refresh" all user's passwords.  It goes through the
           protected password database and sets the successful change time
           to the current time for all users. The result is that all user's
           password aging restarts at the current time.

           May be combined with the -l option.

      -v   This option is specified with a user name to "validate/refresh"
           the specified user's password.  It sets the successful change
           time to the current time.

           May be combined with the -l and/or -m options.

      -x   Delete the user's password and return a random password that the
           user must later supply to the login process to login and pick a
           new password. Not valid for root.  Also resets locks.