topic Customized C2 in Operating System - HP-UX

Customized C2

Alvaro Garcia_1 — Mon, 25 Oct 2004 16:28:08 GMT

Hello

I want to know if is possible to enable c2 in HPUX 11.11 and customize it.

I need to install an ISS server Sensor and I need enable audit but I don´t want any other restrictions like logging device restictions, Automatic user account expiration, forcing all passwords to conform to minimum complex requeriments, Preventing reuse of passwords, account logging restrictions, etc

How can I do that

Re: Customized C2

Sundar_7 — Mon, 25 Oct 2004 16:38:00 GMT

You need to convert to a trusted system. that will make your HP-UX C2-level security complaint.

You can use sam to convert to trusted system or you can use /usr/lbin/tsconvert with -c option.

Once the system is converted, you can enable auditing.

Re: Customized C2

Alvaro Garcia_1 — Mon, 25 Oct 2004 16:41:07 GMT

My question is:

After enable C2 How can I do to disable the new features like logging device restictions, Automatic user account expiration, forcing all passwords to conform to minimum complex requeriments, Preventing reuse of passwords, account logging restrictions, etc?

Re: Customized C2

Sundar_7 — Mon, 25 Oct 2004 17:15:49 GMT

1) Logging device restriction

Dont worry about this one. By default there is no restiction on this one. Moreover, it applies only to hard-wired terminals, not for the pseudo terminals

2) Automatical user account expiration

By default there is no expiration.

3) Password complexity

/sbin/passwd bypasses all the checks for the password validity. You can rename /usr/bin/password to soemthing else and link /usr/bin/passwd to /sbin/passwd. One problem is that, /sbin/passwd by default tries to change the password of root, not the user's as is the case with /usr/bin/passwd

4)Account logging restrictions

There are no account logging restrictions enabled by default.

Re: Customized C2

Sridhar Bhaskarla — Mon, 25 Oct 2004 17:24:02 GMT

Hi,

Once you enable trusting, all the accounts will be expired immediately. You will need to go into 'sam' -> Auditing and Security -> System Security Policies and disable/customize all the options that you need. If you disable everything, what you will have effectively will be the password files in a secured database.

-Sri