topic Re: Convert Solaris passwords to HP-UX in Operating System - HP-UX

Convert Solaris passwords to HP-UX

Bob_165 — Thu, 30 Nov 2006 17:03:16 GMT

I'm trying to migrate from a Solaris system to HP-UX.
My simple try at this was to create a user on the HP box then cut and paste the SUN's /etc/shadow password into the new users /etc/passwd file on the HP. I didn't work.
So I beleive Solaris keeps their hashed passwd in a different format then that of HP-UX. I've googled arround and I beleieve that SUN uses DES hashing and HP-UX uses MD5.
Is there a way to convert these passwords?
I've looked through pam and couldn't find anything.

Thanks in advance for any help!

Re: Convert Solaris passwords to HP-UX

A. Clay Stephenson — Thu, 30 Nov 2006 19:53:51 GMT

I rather doubt that that is your problem although since you haven't bother to identify your HP-UX version or the security setting, it's difficult to know. HP-UX doesn't normally use shadowed passwords per se but rather a Trusted Database. It also commonly uses the traditional /etc/passwd file and this is referred to as "untrusted" mode. Look to see if you have a filetree under /tcb. For example, the password hash for user mmouse is stored under /tcb/files/auth/m/mmouse along with other attributes such as time of last login.

The other gotcha is that HP-UX uses an optional bigcrypt() function to encode passwords whose plaintext exceed 8 characters. This behavior can be changed use PAM modules but it's a non-trivial exercise.

Re: Convert Solaris passwords to HP-UX

Bob_165 — Thu, 30 Nov 2006 23:31:21 GMT

Thanks for the reply.

The HP system is not trusted.

I am migrating from Solaris to HP-UX. The Solaris keeps the password in the /etc/shadow file for example:
jgarza:gXU9S9EyMLFvg:13102::::::

BTY: This password is caddy670 on the Solaris.

The Solaris /etc/passwd file for the same user is:
jgarza:x:1089:15:Johnny Garza:/usr/users/jgarza:/bin/csh

Forgetting the /home dir and the shell info. I am simply trying to move the passwords. The rest I can modify via a vi replace.

The question is; how to I get the Solaris hashed password to be recognized by HP-UX?

I have even tried to install the HP shadow patch thinking that it may do something to the hashing (encryption).No dice.

I have searched and searched; it is hard to believe no one has migrated from a Solaris to and HP without resetting all the passwords. In my case it is over 200.

I have migrated from SCO to HP; and True64 to HP all with no problems.

This forum has always had the answers. I use it all the time. I have searched and can not find anything even close. Google has nothing either.

I keep thinking that SUN is using a different hashing method???

HELP!!

Re: Convert Solaris passwords to HP-UX

BUPA IS — Fri, 01 Dec 2006 03:52:08 GMT

hello,
does this help ? you do not say what the solaris release is . it might be easier to fix them at the solaris end .

http://learningsolaris.com/archives/2006/01/19/password-hashing-algorithm/

http://www.sun.com/software/whitepapers/solaris9/pam.pdf

you would probably have to do a full install of solaris 9 2 to get there . Change the encryption algorithim. Then get everybody to change their password. Then copy the files across.
good luck
Mike .

Re: Convert Solaris passwords to HP-UX

Darren Prior — Fri, 01 Dec 2006 05:00:39 GMT

Hi Bob,

If you have an untrusted HP-UX system and shadow passwords on the Solaris system then you will need to move the encrypted passwords into the /etc/passwd file. In your example:

/etc/shadow file:
jgarza:gXU9S9EyMLFvg:13102::::::

/etc/passwd file:

jgarza:x:1089:15:Johnny Garza:/usr/users/jgarza:/bin/csh

This will need to become the following /etc/passwd entry:

jgarza:gXU9S9EyMLFvg:1089:15:Johnny Garza:/usr/users/jgarza:/bin/csh

However, if appears that your uids do not match - this may or may not be a concern to you.

regards,

Darren.

Re: Convert Solaris passwords to HP-UX

Bob_165 — Fri, 01 Dec 2006 10:29:17 GMT

Hi Mike--

The Sun Solaris version is an old 5.6!
Upgrading the Sun system is not an option.

But you do bring up a point. The HP system is new (no users yet) So that brings up what I was looking at earlier --changing the authentication hashing routine via pam.

The /etc/pam.conf points to libpam_unix.1

# Authentication Management
#
dtaction auth required /usr/lib/security/libpam_unix.1
dtlogin auth required /usr/lib/security/libpam_unix.1
ftp auth required /usr/lib/security/libpam_unix.1
login auth required /usr/lib/security/libpam_unix.1
su auth required /usr/lib/security/libpam_unix.1
OTHER auth required /usr/lib/security/libpam_unix.1

Under the /usr/lib/security there are these files:

libpam_authz.1 libpam_krb5.1 libpam_ntlm.1 libpam_updbe.1
libpam_dce.1 libpam_ldap.1 libpam_unix.1

I am wondering if unix.1 is MD5 and dce.1 is DES??

Darren---that was the first thing I tried..

Thanks for the replies so far!!

Re: Convert Solaris passwords to HP-UX

Bob_165 — Fri, 01 Dec 2006 11:18:11 GMT

Well---I tried changing the one line in pam.conf:

login auth required /usr/lib/security/libpam_unix.1

To each one of these:
libpam_authz.1 libpam_krb5.1 libpam_ntlm.1 libpam_updbe.1
libpam_dce.1 libpam_ldap.1

No luck---I knew ldap.1 would not work.
Some actually let you in without a password.
I did try the HP-UX shadow patch. That did not change the hashing.
So I'm still stuck.

Re: Convert Solaris passwords to HP-UX

A. Clay Stephenson — Fri, 01 Dec 2006 11:53:50 GMT

Try this on both your Solaris box and your HP-UX box for a single known user. If you haven't created a user on the HP-UX end, do so now (or you can simply use root):

Examine the password hash and note the 1st 2 characters (the "salt"). Next run this Perl one-liner:

perl -e 'print crypt("secret","Eb"),"\n";'

where "secret" is the plaintext password and "Eb" is the salt mentioned above. The output will be the password hash. When these two match on box boxes, you have equivalent password hashing.

Re: Convert Solaris passwords to HP-UX

Darren Prior — Fri, 01 Dec 2006 12:02:25 GMT

Is Solaris using crypt for shadow passwords though? HP-UX uses bigcrypt for trusted systems, so those encrypted passwords would be no use on a non-trusted system. In the same way, if Solaris is not using crypt then you'll not be able to use the same encrypted passwords.

Looking at this from another angle, why don't you make people enter new passwords? It's generally considered good security to change passwords on a regular basis.

regards,

Darren.

Re: Convert Solaris passwords to HP-UX

Bob_165 — Fri, 01 Dec 2006 12:54:43 GMT

Clay,

That's a good test except they do not have perl on the Solaris system.

I pretty sure that will tell me what I already know..the hashing is different between a Solaris 5.6 and HP-UX.
I was hoping there is something I could change on HP-UX to translate the Solaris hashed password. I had hoped it was in the pam.conf. It may still be. I have got to do some more research on those pam lib files

Daren,

I doubt they are running anything but striaght Solaris 5.6, with no extra crypting.

On the HP side I've tried untrusted..but not trusted. I'll try that this afternoon and stick the password from the Solaris /etc/shadow into the approprate HP-UX /tcb/auth file.

While I agree it's a good practice to change the passwords every 90 days or so. It is just not the best time to do this when you are going live on a new system.

Re: Convert Solaris passwords to HP-UX

Peter Nikitka — Fri, 01 Dec 2006 13:02:06 GMT

Hi,

the idead of merging the shadow passwd-data into /etc/passwd will work.
Use these lines on your solaris box to create a 'HP-UXable' /etc/passwd:

nawk -F: 'BEGIN { while (getline<"/etc/shadow" == 1) pw[$1]=$2; close("/etc/shadow");OFS=FS}
{if (!pw[$1]) pw[$1]="*NONE*";print $1,pw[$1],$3,$4,$5,$6,$7}' /etc/passwd

You'll better remove system accounts from this output and append it to your /etc/passwd on the HP-UX box.

Password aging is lost, though you could use the data in /etc/shadow to compute an equivalent aging string for /etc/passwd.
You better set in up for new, if you require this.

mfG Peter

Re: Convert Solaris passwords to HP-UX

Geoff Wild — Fri, 01 Dec 2006 15:31:59 GMT

You could always try converting your HP-UX to shadow passwords.

There is some info in:

http://devrsrc1.external.hp.com/STK/impacts/i833.html

As well as download here:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ShadowPassword

Rgds...Geoff

Re: Convert Solaris passwords to HP-UX

Bob_165 — Fri, 01 Dec 2006 17:09:47 GMT

Peter,

It looks as though this moves the data from shadow and combines it into passwd (standard).
Unless I'm missing something the problem is in the hashing. Of course I can't be certain since I could not run the perl script on the SUN box.

Geoff,

Tried the shadow patch yesterday. I really thought I was on to something, but no.

I wonder if should close this thread and start a new one that has to do with the hashing problem?

Re: Convert Solaris passwords to HP-UX

Geoff Wild — Fri, 01 Dec 2006 17:25:53 GMT

I have a call into HP on this - as I am interested as well.

There was a presentation at this year's HP Tech Forum on "Sun Porting & Migration to HP".

I'll let you know the results as soon as they get back to me.

Rgds...Geoff

Re: Convert Solaris passwords to HP-UX

Bob_165 — Fri, 01 Dec 2006 18:35:27 GMT

OK-

Here's what I have found out so far.

On the SUN box I changed the passwd of the same user I've been battling since yesterday morning to the same password he had before.
I cut and pasted it and it worked on HP!!

I then cut and pasted the root passwd from the SUN box to this same user on the HP and it worked!

Strange since the orginal password did work on the SUN.

I am thinking they are useing the Solaris GUI admintool it may give an option to encrypt the password into something unknown.

I'm going to close this thread--
This is my first post and I feel stupid that I didn't try this before!

Thanks for everyones help on this! And thank this forum..I've used this for years and I always find the answers!!

Re: Convert Solaris passwords to HP-UX

Bob_165 — Fri, 01 Dec 2006 18:36:09 GMT

see above