topic Re: converting to trusted mode again in Operating System - HP-UX

converting to trusted mode again

John Carr_2 — Fri, 19 Dec 2003 08:36:26 GMT

I have server all patched up to latest releases for 10.20 o/s. Using SAM to attempt to change to trusted mode I received an error "cant write protected database; password file unchanged" any ideas ?

:-) john.

Re: converting to trusted mode again

Elmar P. Kolkman — Fri, 19 Dec 2003 08:38:30 GMT

You have of course checked for full / filesystem or existing /tcb directory, haven't you?

Re: converting to trusted mode again

Pete Randall — Fri, 19 Dec 2003 08:38:37 GMT

John,

Try it manually using tsconvert (no options, just tsconvert). If it doesn't work, maybe you'll get more info.

Pete

Re: converting to trusted mode again

Elmar P. Kolkman — Fri, 19 Dec 2003 08:40:13 GMT

Also check /etc/passwd for entries not starting with an alpha character.

Re: converting to trusted mode again

Robert-Jan Goossens — Fri, 19 Dec 2003 08:41:59 GMT

Hi John,

# pwcheck /etc/passwd

Regards,
Robert-Jan

Re: converting to trusted mode again

Jeff Schussele — Fri, 19 Dec 2003 08:45:30 GMT

Hi John,

New hat's cool...

Check these:

1) full / FS
2) passwd file integrity - pwck
3) Perms on /tcb if it already exists

HTH,
Jeff

Re: converting to trusted mode again

John Carr_2 — Fri, 19 Dec 2003 08:59:11 GMT

Hi

Elmar

plenty of disk space no problem there and no /tcb to check this is part of the creation process.

Robert

pwck shows 2 user accounts with comments at start of line and one account which it could not find home dir !

Jeff

your suggestions already covered thanks

Pete

I shall try the manual tsconvert
and this is what i got :

# ./tsconvert
Creating secure password database...
Directories created.
Making default files.
System default file created...
Terminal default file created...
Device assignment file created...
Moving passwords...
Can't write protected database;
password file unchanged.
# ls -la /tcb
/tcb not found

tsconvert has NOT created any tcb directory or if it did it deleted it too.

:-( John.

Re: converting to trusted mode again

Elmar P. Kolkman — Fri, 19 Dec 2003 09:06:48 GMT

John,

comment (hash) signs are NOT allowed in /etc/passwd, so make a backup of /etc/passwd and then remove those users from the file and tsconvert should work.

Re: converting to trusted mode again

John Carr_2 — Fri, 19 Dec 2003 09:12:43 GMT

Elmar

just about to post you the output of pwck I suspect you hit the nail on the head I need to get sign off to do this without these accounts they may be needed later will be back with answer asap.

John.

Re: converting to trusted mode again

Elmar P. Kolkman — Fri, 19 Dec 2003 09:14:50 GMT

In that case, just lock the users by changing the crypted passwd to something like '*LK*'. That way the users are disabled, but still exist and you only have to change the passwd as root and they are usable again.

Re: converting to trusted mode again

Pete Randall — Fri, 19 Dec 2003 09:15:10 GMT

John,

I suspect it's the comments then. Once you remove them, it should work.

Pete

Re: converting to trusted mode again

Pete Randall — Fri, 19 Dec 2003 09:15:51 GMT

John,

Oops, I forgot (again) to mention: nice hat!!

Pete

Re: converting to trusted mode again

Darren Prior — Fri, 19 Dec 2003 09:24:16 GMT

John,

yes - it will be those comments in /etc/passwd!
At that part of the conversion it will have been struggling to find the right dir for the first letter of their login...

regards,

Darren.

Re: converting to trusted mode again

John Carr_2 — Fri, 19 Dec 2003 09:26:37 GMT

Hi

all sorted and YES it was the comment lines.
also there was a bad login account with no home directory but this did not stop the conversion.

thanks for the help - thread closed

:-) John.