topic Re: Trusted System in Operating System - HP-UX

Trusted System

Paul McCleary — Tue, 06 Nov 2001 14:47:24 GMT

Does anybody know what the overhead of implementing a trusted system is? Other than performance (any idea what the performance hit is?).

Are there other issues such as not being able to recover when the root password is lost etc?

I know what the advantages are, just need to be aware of the negatives.

Thanks, Paul

Re: Trusted System

G. Vrijhoeven — Tue, 06 Nov 2001 14:53:03 GMT

Hi Paul,

Just take a look at the history in the formum on this subject.

the URL:

http://europe-support2.external.hp.com/emse/bin/doc.pl/sid=cb06260500bf33dcdd?todo=search&searchtext=trusted+system&searchcriteria=allwords&searchtype=SEARCH_FORUMS&searchcategory=ALL&rn=25&presort=rank

hope this will give you some ideas

Gideon

Re: Trusted System

Bernie Vande Griend — Tue, 06 Nov 2001 15:59:42 GMT

Really no performance hit that would be noticed.

Root password can still be reset from single user mode unless you set up the option to require a password in single user mode. Only trusted mode gives you that option. if you choose that option, HP says it is wise to have a backdoor for getting root password back or converting to untrusted:
http://us-support3.external.hp.com/cki/bin/doc.pl/sid=577630d41b9e076ca5/screen=ckiDisplayDocument?docId=200000048456189

As far as other negatives:
Not all applications work with Trusted mode. Some older applications are written poorly and have trouble with authentification as Trusted demands passwords of at least 6 characters.
Also, users may have to choose new passwords whenever you convert to Trusted mode or convert back.
You may find root's account disable on occasion as the default is 3 failed attempts. When that happens you need to login from the console as root to get in to clear it up again. We upped this to 5 on our systems so it doesn't happen as frequently.
The key is to test your applications running in trusted mode to make sure everything still functions properly.

Re: Trusted System

Roger Baptiste — Tue, 06 Nov 2001 16:14:19 GMT

hi,

There is *NO* performance overhead with Trusted systems.

I don't see any negatives from the system-side. The improved restrictions on number of bad logins, disabling of accounts, expiry of accounts, passwords etc
are all security features and
not negatives.

The only problem i faced with trusted system was not
able to get it to work with a
NIS+ setup. This was a year
back. I am not sure whether
the problem got resolved.

Other than that, i don't
see any issues. We run trusted
setup on all the boxes without
any issues.

For applications, an account
is an account whether it is
a trusted one or not.

HTH
raj

Re: Trusted System

Michael Tully — Tue, 06 Nov 2001 22:05:26 GMT

Hi,

Other than what has already been mentioned, you will find that *ALL* accounts will have their passwords expired upon making your system trusted. This can be a disadvantage if your user community is not prepared for it. If they are unaware you could have a mutiny on your hands.

HTH
-Michael