Enable trust environment

[augusto cossa]

Hi,

What are the implication or impact on enabling trust environment on HP-UX systems running 11i.

Look how my system are configured:

Processors: 1
CPU Version: 2.0 PA8600
Clock Frequency: 540 MHz
Hardware Model: 9000/800/L1000-5X
Kernel width Support: 64
Physical Memory: 1024.9 MB
OS Identification: B.11.00 U

Thanks,

Augusto

[RAC_1]

No impact per se.

all accounts will expire when you convert to c2-trusted mode.
execute /usr/lbin/modprpw -V to avoid this.

What you get once converted to c2 level.

auditing can be done.
better security control.
you can specify min password lenght and lot of other params.

[Michael Tully]

Two big problems that I come across:

First *all* passwords by default expire. Fantastic for users who enjoy some mutiny. 'root' account as well.
The second is that some applications do not like it at all. Make sure if you test it thoroughly on a test or dev server before implementing for real even if the application vendor supports it.

If you need to back it out, run
# /usr/lbin/tsconvert -c'

[Darren Prior]

Hi Augusto,

In addition to Anil's notes, ensure your applications are able to support a trusted system. There are different system calls used to access the password data to authenticate. As the encrypted password is no longer in /etc/passwd it could confuse an application that isn't aware of this into believing the account is disabled!

regards,

Darren.

[Timothy P. Jackson]

I ran into a couple of things, some were already mentioned. The two biggest ones were the different system calls and libraries that are used with a secured system. The second is that you are using NIS you will have to convert to NIS+. In a large environment this is quite a task.

Tim