Trusted Mode

[Javier Ballesteros]

Hi,
We are investigating the possibility of converting our HP-UX 10.20 systems to Trusted Mode. I think the only information available from HP is the manual "Administering Your HP-UX Trusted System",
which seems to apply to version 10.10.
According to this manual there are several prerequisites:
- setting SECURE ON at the ISL prompt
(this command doesn?t exist at 10.20?)
- installing the security patches
(which you can order from an e-mail address
that doesn't work anymore).

Questions:
- Does anyone know additional documentation
about Trusted Mode?
- Does anyone know something about SECURE ON?
- Can someone tell me how to get a list of
the security patches?
- Does anyone have experience with Tusted Mode?

Thanks a lot a lot.

[Steve Massey_1]

Hi
Only a bit to offer.
easy way to convert passwd file to TCB is to use SAM
another option is to /usr/lbin/tsconvert
this just removes password from passwd file and creates DIR structure under /tcb
I am not familiar with any ISL needs though.
Prehaps others can offer.

Steve

[Cheryl Griffin]

- Does anyone know additional documentation
about Trusted Mode?
From http://www.docs.hp.com, Select the link for Internet & Security Solutions. Under Security Products, there are 3 choices which cover trusting and security.

- Can someone tell me how to get a list of
the security patches?
From the ITRC Main Page at http://www.itrc.hp.com (You will be required to login to gain access to the patch database.) Select the tab at the left for Maintenance/Support. Under Notifications, select Support Information Digest. You can view or subscribe to current and archived security bulletins.

[Andy Monks]

To turn 'SECURE ON', you have to do it while booting the machine.

When you get the option to 'interrupt autoboot', interrupt it.

Then depending on bios version what's next, but you need to get the configuration options.

Then, if you type in 'secure', it will tell you how it's set.

However, should you turn secure on, you won't be able to turn it off (as it stops you interrupting the autoboot).

So, if you computer/console is in a secure environement, it may not be worth doing. If not, ensure you have the alternate boot path setup first!