topic Re: shadowing /etc/passwd in Operating System - HP-UX

shadowing /etc/passwd

John_608 — Tue, 02 Dec 2003 09:10:19 GMT

I am running d class server with hpux 10.20 how do i shaddow the password file tsconvert does not seem to exist as in hpux11

Re: shadowing /etc/passwd

Patrick Wallek — Tue, 02 Dec 2003 09:11:39 GMT

tsconvert does exist in HP-UX 10.20. It is in the /usr/lbin directory.

Re: shadowing /etc/passwd

John_608 — Tue, 02 Dec 2003 09:14:18 GMT

do i simply run this as i do in 11.X

Re: shadowing /etc/passwd

melvyn burnard — Tue, 02 Dec 2003 09:27:26 GMT

Yes
But the BETTER way is to run it from SAM, as there have been known issues with running the manual command

Re: shadowing /etc/passwd

Patrick Wallek — Tue, 02 Dec 2003 09:28:22 GMT

Yes. It works pretty much the same as in 11.

Re: shadowing /etc/passwd

Darren Prior — Tue, 02 Dec 2003 09:59:18 GMT

Hi,

Please ensure your system is well patched BEFORE you run tsconvert. The supported way to convert the system is via SAM, which of course uses tsconvert.

There are a number of trusted system patches that you must have otherwise tsconvert can cause problems.

regards,

Darren.

Re: shadowing /etc/passwd

John_608 — Tue, 02 Dec 2003 10:45:26 GMT

can someone please tell me patches are needed as this machine is not patched.

points to be awarded at end.

thanks
john.

Re: shadowing /etc/passwd

Darren Prior — Tue, 02 Dec 2003 10:55:21 GMT

Hi John,

at the very least you need:

PHCO_8246
PHCO_8247
PHCO_17218
PHCO_22768

and the following SAM patches:

PHCO_12236
PHCO_22268

You must also realise that there are many other essential patches for 10.20 (ie PHKL_16751), and that it is an obsolete, out of support OS.

regards,

Darren.

Re: shadowing /etc/passwd

Emil Velez — Tue, 02 Dec 2003 19:19:26 GMT

tsconvert is the trusted systems conversions. the passwords are put in /tcb

HPUX 11.11 supports the true shadow password functionality with pwconv and pwunconv.

I just wanted to make sure you understand that this is not the shadow password functionaity.

Sam can convert a system from trusted mode and back when you go into auditing and security.

Good luck

Re: shadowing /etc/passwd

John_608 — Wed, 03 Dec 2003 04:34:23 GMT

in hpux 11 tsconvert creates a /tcb directory but i cant see where the files are in 10.20 any help appreciated.

Re: shadowing /etc/passwd

Darren Prior — Wed, 03 Dec 2003 05:05:33 GMT

Hi John,

The files are under /tcb at 10.20 too. If you've already trusted the system then /etc/passwd will have asterisks instead of passwords for each user.

It really is better to use SAM to trust the system, it is the supported way and I think it gives you more info if there are errors. Did tsconvert complete successfully, were there any error messages returned, was the return code 0?

regards,

Darren.

Re: shadowing /etc/passwd

John_608 — Wed, 03 Dec 2003 05:34:00 GMT

Darren i am looking at a converted system. not by me. and there are asterics in the passwd file but no /tcb directory. when tsconvert is run or sam is run can a different directory be specified ?

cheers
John.

Re: shadowing /etc/passwd

Darren Prior — Wed, 03 Dec 2003 05:44:26 GMT

Hmmm - and the accounts with asterisks includes non-system accounts? (lp, bin and a few others are normally disabled and so have an asterisk in their passwd field.)

To the best of my knowledge there is no choice of directory for /tcb, so if /tcb doesn't exist then something has gone wrong.

Is the system patched with the tsconvert and SAM patches? Are all the other critical patches installed?

The following command will highlight any unconfigured filesets:
swlist -l fileset -a state | grep -ve configured -e \#

regards,

Darren.

Re: shadowing /etc/passwd

John_608 — Wed, 03 Dec 2003 06:16:44 GMT

Darren

guess who only looked at the initial part of the passwd file for asterics ! sorry i wasted your time problem resolved.

John.

Re: shadowing /etc/passwd

Hazem Mahmoud_3 — Wed, 03 Dec 2003 06:30:40 GMT

Just an fyi, but if you want to know if a system has been converted to a trusted system, execute "/usr/lbin/getprdef -r". If it says something to the effect of "your system is not trusted", then you'll know. That's usually a quicker and surer way of knowing.

-Hazem