topic Re: converting to trusted machine in Operating System - HP-UX

converting to trusted machine

Trng — Wed, 15 Jul 2009 08:32:44 GMT

Dear All,

i have few hpux servers which includes two node clusters (hpux 11.23,mcsg 11.16) .All are standard systems not trusted machines.i am planning to convert to trusted machines...

1--what are the basic requirements to do that
2-What are the challenges
3-once convert ,is there any issu with oracle database/sap application(is this trusted conversion will do any changes in database/application end?
4-how to rollback ?what are the challenges

Hope all Gurus participation on this thread .

rgds
skr

Re: converting to trusted machine

Kapil Jha — Wed, 15 Jul 2009 09:01:36 GMT

Hello Trng,

1. Basic requirement is ur system should not be running on shadow file system.
If yes change it to normal passwd mode
by pwunconv

2.No challenges except lil passwrd stuff see the below link

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=317809

3.There would not be any kindda issue when u cahnge the passwd mode.

4./usr/lbin/tsconvert -r (* unconvert *)
will unconver.

The only thing as per me should be taken care is we should always have a root session open till the activity finish, else you will have to reboot server in single usermode to have root passwd.

BR,
Kapil+

Re: converting to trusted machine

Trng — Wed, 15 Jul 2009 09:48:16 GMT

converting a macine from stand to trusted requires reboot ?

database/application needs to be shutdown ?

does passwd to be changed before converting to trusted ?

i have bussiness critical production machines are there ,so this many concerns ..

rgds
skr

Re: converting to trusted machine

Mel Burslan — Wed, 15 Jul 2009 12:31:55 GMT

Before you commit to this activity, please take a look at this page:

Known problems and limitations of trusted computing and possible workarounds:

http://docs.hp.com/en/5992-0553/ar01s03.html?btnNext=next%A0%BB

Also, hp is phasing out trusted computing in favor of security enhancements module in the later versions (I think 11.23 is included) of the hpux. You might want to talk to HP regarding this option.

HTH

Re: converting to trusted machine

Ganesan R — Wed, 15 Jul 2009 12:51:44 GMT

Hi,

>>converting a macine from stand to trusted requires reboot ?

database/application needs to be shutdown ?

does passwd to be changed before converting to trusted ?
<<

Answer for all your question is NO. Converting the system into trusted is not a challanging task.

Re: converting to trusted machine

Ganesan R — Wed, 15 Jul 2009 12:52:44 GMT

Hi Again,

I forgot to add one thing. The recommanded way to convert the system is through SAM.

Re: converting to trusted machine

James R. Ferguson — Wed, 15 Jul 2009 13:05:46 GMT

Hi:

Why do you want to convert to a Trusted system given that you are running 11.23 and given that 11.31 is scheduled to be the last release to support Trusted configurations?

I would seriously reconsider your objectives and implement the Shadow password mechanism with its attendent enhancements.

Regards!

...JRF...

Re: converting to trusted machine

Trng — Thu, 16 Jul 2009 03:39:18 GMT

Dear All,

we are not planning to upgrade 11.23 to 11.31 i another 2-3 years.so we want to go ahead with trusted mode conversion.does anyone has trusted mode conversion documentation on 11.23 ?.what are the advantages on converting a system to trusted ?

Re: converting to trusted machine

James R. Ferguson — Thu, 16 Jul 2009 11:15:51 GMT

Hi (again):

> we want to go ahead with trusted mode conversion.does anyone has trusted mode conversion documentation on 11.23 ?.

See:
http://docs.hp.com/en/B2355-90950/ch08.html

_BUT_ also see:
http://docs.hp.com/en/5991-8678/index.html

...and remember that Trusted security will not be supported after 11.31 (11iv3).

Regards!

...JRF...

Re: converting to trusted machine

Suraj K Sankari — Thu, 16 Jul 2009 11:34:16 GMT

Hi,
See the below link

how to convert and advantage of trusted mode.

http://docs.hp.com/en/B2355-90950/ch08s08.html

Suraj

Re: converting to trusted machine

Suraj K Sankari — Thu, 16 Jul 2009 11:34:37 GMT

Hi,

Please assign some points who give there valuable time for your problem.

To know how to assign points please go through the below link.

http://forums13.itrc.hp.com/service/forums/helptips.do?#33

Suraj