ssh connection failed after activating Trusted system

[srayfay]

hello,

I converted my HPUX V3 to a trusted system by using SAM; After that I can't log on with my root user and any other user. I can't do any ssh, even the console login failed "incorrect password"

I have install the last PHCO of modprpw thinking that could resolve something.

what is the probleme?

PS : after enabling I let my console open to not loose control of the server so I can unconvert

[Dennis Handly]

Have all of the passwords been expired when you converted?

[srayfay]

Hello,

Seems like so,

I dont realy know how to resolve this.

HP Support sayed that I have to check the lenght of root password, it must be less than 8 caracters, and install the last patch of modprpw PHCO_41574. Everything is done, once truset system is activated, nobody can logon !

[Matti_Kurkela]

A quick way to "un-expire" all accounts is:

/usr/lbin/modprpw -V

You should also make sure the root account is set to not expire:

/usr/lbin/modprpw -l -m lftm=0,exptm=0,mintm=0,expwarn=0,llog=0 root

Note that the default (non-trusted) password mode will store only the first 8 characters of passwords; when in default mode, this is not a problem as the password checking routines will ignore any characters beyond 8. But after switching to trusted system mode, all the characters typed by the user are checked.

So if the user has used a 9-character or longer password until now, after the conversion to Trusted mode the user must first type _only the first 8 characters_ of his/her old password. When the user changes his/her password while Trusted mode is in effect, all the characters will be stored (up to the configurable maximum password length limit) and then the password will work normally again.

[srayfay]

Hi, thank you for your answers

I tried the two commands, nothing hapened !! I can't acces, even remsh !

[Bill Hassell]

When you run ssh from another machine, add the -vvv (three lowercase "v" characters) so all the steps with ssh negotiation are shown.You need to run a command line version of ssh, perhaps from another HP-UX or Linux system.

Also verify that the problem system can resolve it's own name:

nslookup $(hostname)

[BowlesCR]

Do you have a good reason to run Trusted mode?

For most purposes, running in Shadow mode (StdModSecExt) is equivalent and far easier to manage. I would recommend unconverting from trusted to standard and then converting to shadow.

[srayfay · Accepted solution]

the solution is to check /etc/nsswitch

there is a user defined there by default, I delete that line and I let the authentification mode file then DNS.

it's working !