topic Re: Trusted Systems in Operating System - HP-UX

Trusted Systems

ralph barber — Thu, 13 Mar 2003 11:34:04 GMT

We have recently started converting our HPUX 11.00 systems
to Trusted Systems however on converting the first two systems we found that about 20% of our users when they first logged in were prompted for their old password however when they entered it they were told there was no record of their old password and the connection was terminated. Does anyone know what causes this and how it can be avoided in future conversions.

Re: Trusted Systems

RAC_1 — Thu, 13 Mar 2003 11:39:02 GMT

when you convert to trusted mode, all passwords get expired. so user will be prompted to entre for new password. To avoid this execute
/usr/lbin/modprpw -V after converting to trusted mode.

Re: Trusted Systems

ralph barber — Thu, 13 Mar 2003 11:45:13 GMT

Thanks Anil that's handy to know - still curious to know why so many users did not have their old passwords recognised.

Re: Trusted Systems

Michael Steele_2 — Thu, 13 Mar 2003 11:54:10 GMT

Here are some more basic trusted system commands:

authck -p (* verifies the integrity of the protected trusted password file in /tcb *)

getprpw (* alock = yes then disabled account *)

modprpw -a alock = NO (* to unlock disabled account *)

Re: Trusted Systems

RAC_1 — Thu, 13 Mar 2003 12:05:14 GMT

run pwck and grpck befre converting. Also authck after conversion.

Re: Trusted Systems

ralph barber — Thu, 13 Mar 2003 17:13:13 GMT

We did run pwck and grpck before conversions
nothing untoward found

Re: Trusted Systems

Darren Prior — Thu, 13 Mar 2003 17:28:50 GMT

Hi Ralph,

There can be issues with password greater than 8 characters when the system is converted. This may account for your 20% of users having the problem.

regards,

Darren.

Re: Trusted Systems

ralph barber — Thu, 13 Mar 2003 17:33:32 GMT

Thanks that would make sense as I know quite a few of our users were using passwords longer than 8 characters

Re: Trusted Systems

Steven E. Protter — Thu, 13 Mar 2003 17:37:22 GMT

If you haven't been using password aging or your password aging is greater than 60 days, when you go trusted, the default password age is 60 days.

Any user with a password over 60 days old gets expired.

Hence the problem.

As far as there being no record of the old password, that should not happen.

SEP

Re: Trusted Systems

Darren Prior — Thu, 13 Mar 2003 17:39:48 GMT

Re: passwords over 8 chars.

I believe if they had entered just the first 8 chars of their long password they'd be able to change their password.

regards,

Darren.

Re: Trusted Systems

ralph barber — Thu, 13 Mar 2003 17:43:25 GMT

Stephen
We did have password aging set to 28 days so that wasn't the issue in our case