topic /etc/default/security vs Trusted System in Operating System - HP-UX

/etc/default/security vs Trusted System

Ray Allen_1 — Wed, 08 Oct 2008 19:18:34 GMT

Hi All,

Hopefully a quick question. We are enabling our HPUX servers to Trusted System. I just wanted to clerify if /etc/default/security is needed with Trusted System, Don't need it at all, or replaced by Trusted System?

I basically want to know if it is needed after converting to Trusted System.

Thanks a million

Re: /etc/default/security vs Trusted System

Ivan Krastev — Wed, 08 Oct 2008 19:26:31 GMT

Yes, security file is used in trusted systems as well.
See managing passwords in trusted mode - http://docs.hp.com/en/B2355-90950/ch08s10.html

regards,
ivan

Re: /etc/default/security vs Trusted System

Robert-Jan Goossens_1 — Wed, 08 Oct 2008 19:43:37 GMT

Hi Ray,

Have a look at the security manual, it describes for each option if it applies for trusted systems.

11.23 example
http://docs.hp.com/en/B3921-60631/security.4.html

Regards,
Robert-Jan

Re: /etc/default/security vs Trusted System

Ganesan R — Thu, 09 Oct 2008 08:29:52 GMT

Hi,

There are many parameters you can set in security which cannot be set on trusted configurations. Like Password history depth,
Number of logins allowed per user, How to behave when user home dir is missing, Password min upper/lower/special characters,
ignorance of /etc/nologin file, etc.

security file will be referred even after the system is converted to trusted.

Re: /etc/default/security vs Trusted System

Ray Allen_1 — Thu, 09 Oct 2008 12:27:48 GMT

Thanks all. I appreciate your input.

Re: /etc/default/security vs Trusted System

Bill Hassell — Fri, 10 Oct 2008 01:13:35 GMT

Your Trusted system will use /etc/default/security if it exists, but it is not required. Instead, it provides extended security features that are very dependent on security patches. The man page for security on your system is the correct reference. If you use the online man page, you'll see options that may not work until you bring your patches up to date. The security file controls all 3 authentication environments: standard, Trusted and shadow password. But the man page will describe which options apply.

The security file has an two undocumented features:

1. The # sign acts as a comment character but unlike almost every UNIX style of comment handling, trailing # signs at the end of an option turn the entire line into a comment.

2. There are no diagnostics. So if you misspell an option or give it an invalid value, you'll not see the error in any log. The only way to see if an option works is to test it.

Re: /etc/default/security vs Trusted System

Ray Allen_1 — Tue, 21 Oct 2008 17:39:00 GMT

Points and advise well taken.
Thanks.