topic Re: Need Some Advices in Operating System - HP-UX

Need Some Advices

morganelan — Thu, 22 Sep 2005 03:02:15 GMT

Hi Unix Gurus,
I want input from all unix Gurus that have ever done conversion from untrusted system to trusted system,what issues that have been faced with this changing?I appreciate any inputs.Thanks in advance.

Re: Need Some Advices

Joseph Loo — Thu, 22 Sep 2005 03:10:17 GMT

hi,

if u search ITRC or KB, there r lots of info about what problem was encounter.

what is the UX version? do u run clustering, i.e. MCSG?

regards.

Re: Need Some Advices

Muthukumar_5 — Thu, 22 Sep 2005 03:11:01 GMT

Which o/s you are trying to change to trusted system. You will get secured machine.

check this threads:

http://docs.hp.com/en/B2355-90121/index.html
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=638058

It will give related details.

You can convert your machine with sam or tsconvert command itself.

hth.

Re: Need Some Advices

morganelan — Thu, 22 Sep 2005 03:12:43 GMT

HPUX version 11.11

Re: Need Some Advices

Gavin Clarke — Thu, 22 Sep 2005 03:26:37 GMT

I've converted to trusted systems several times. It has never been particularly troublesome and when I did have the 8 character password problem there was an answer on the forum.

According to posts on the forum MC ServiceGuard will not be affected (it wasn't for me). NIS will though, see this post:

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0xe505a22d6d27d5118fef0090279cd0f9%2C00.html&admit=-682735245+1127376641324+28353475

Cheers.

Re: Need Some Advices

RAC_1 — Thu, 22 Sep 2005 03:27:33 GMT

Few things to take care of

1. all passwords will expire. As soon as you convert , do modprpw -V, or better tsconvert ; modprpw -V

2. conversion only convets first 8 chars on password. So passwords longer than 8 chars do not work.

Re: Need Some Advices

Arunvijai_4 — Thu, 22 Sep 2005 03:35:49 GMT

Take a look at this doc, it is for 11.11
http://docs.hp.com/en/B2355-90121/ch01s04.html

-Arun

Re: Need Some Advices

Zigor Buruaga — Thu, 22 Sep 2005 03:47:07 GMT

Hi,

I've done several times, always using SAM, and never found a problem. To be safe, make a copy of your /etc/passwd file first. Also, if I remember correctly, if you have any user commented out on /etc/passwd, SAM
won't let you convert to trusted ( not sure if that's applicable actually ).
In SAM, it's quite easy to define the passwd aging policies, terminal policies, etc.
In this forums, you will find several scripts that will help you, once converted to trusted, to unlock user account and tell you why it was locked, to calculate in how many days a user passwd will expire ... all very useful.

Once converted to trusted, and to be more "auditable" ( I know you are not asking this though ), you can
play also with /etc/default/security file, here you can define the passwd history depth, define a group of users able to do "su" to root, etc. Only an idea ...

Regards,
Zigor

*Not a Unix Guru but trying to help

Re: Need Some Advices

morganelan — Thu, 22 Sep 2005 03:49:02 GMT

How about rcp script? Can rcp script running on trusted system without any changes?

Re: Need Some Advices

Zigor Buruaga — Thu, 22 Sep 2005 03:54:12 GMT

Hi,

Yes, you should be able to use those scripts without changes.
Only be sure that the user on remote host is enabled.

Regards,
Zigor

Re: Need Some Advices

Arunvijai_4 — Thu, 22 Sep 2005 03:56:46 GMT

You mean, RC scripts ? Yes, They will without any changes.

-Arun

Re: Need Some Advices

Zigor Buruaga — Thu, 22 Sep 2005 04:03:54 GMT

Hi,

I thought you were referring to scripts using rcp ( remote copy ) between trusted systems.
If not, sorry if I misunderstood the question.

Regards,
Zigor

Re: Need Some Advices

morganelan — Thu, 22 Sep 2005 04:13:09 GMT

yes rcp remote copy script.

Re: Need Some Advices

morganelan — Thu, 22 Sep 2005 04:19:07 GMT

Trusted system used much space for its log files???

Re: Need Some Advices

Arunvijai_4 — Thu, 22 Sep 2005 04:21:23 GMT

Yes, it will generate lot of log files.

Re: Need Some Advices

Zigor Buruaga — Thu, 22 Sep 2005 04:28:44 GMT

Hi,

Not sure what are you referring by log files. Under the /tcb, where the trusted database resides, you will find a file per user ( under his corresponding directory - first char of the user name - ).
If you are going to enable the auditing, then you will need too much space than that, but a normal conversion to trusted does not really needs too much space ( if I remember correctly, mine needs around 20MB, without auditing ).

Regards,
Zigor

Re: Need Some Advices

Gavin Clarke — Thu, 22 Sep 2005 04:29:13 GMT

Perhaps you should take a look at logrotate, which you can search for on the forums.

Trusted systems do generate alot of log files if you have auditting switched on, you don't have to have it on all the time though.

I find the log files manageable enough.

Re: Need Some Advices

Muthukumar_5 — Thu, 22 Sep 2005 04:37:24 GMT

Trusted systems will not make a problem on r* commands execution.

/etc/passwd files second tab entry will be changed to *. You have to take a copy of /etc/passwd file before execution. Anyway all login's passwd will be expired.

If you don't want to enable system auditing then it will not be going to use more space for log files. Use history setting itself for that.

Sample try is here:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=666461

hth.

Re: Need Some Advices

morganelan — Thu, 22 Sep 2005 04:44:29 GMT

Can we maintain trusted log file on mount point that not belong to vg00.For example audit log files we put on /dev/vg01/lvol1?

Re: Need Some Advices

Gavin Clarke — Thu, 22 Sep 2005 05:17:25 GMT

I think you can, try man audsys (the -c option) and man audit for more information.