trusted system

[rajesh73]

HI

I have rp3440 server and i installed hp-ux 11.11
how to trust the system

any one help me very urgent

[Hakki Aydin Ucar · Accepted solution]

Hi,
The preferred method of converting a system to Trusted Systems is by using SAM. The resulting files and directories that manage the Trusted Computing Base (TCB) are sensitive to inappropriate editing (don't mess it up) leading to a system which may lock out every user, including root. Such a situation would probably need the use of the Recovery Media, the Recovery Shell, and some clever backing out of the TCB configuration.

To enable Trusted Systems from within SAM, you would navigate from the Main Menu - Auditing and Security and then to any of the four sub-menus titled "Audited Events," "Audited System Calls," "Audited Users," or "System Security Policies."

http://docs.hp.com/en/B2355-90950/ch08s08.html

[Raj D.]

Rajesh,
Using command prompt to convert into trusted mode :
# cd /usr/lbin
# ./tsconvert

To verify trusted sytem:
# cd /usr/lbin ; ./getprpw username

More info: HP-UX Trusted System reference: http://docs.hp.com/en/B2355-90121/ch01s02.html


Hth,
Raj.

[Sajith P V]

use /etc/tsconvert -c to convert to trusted mode.
users with passwd more than eight characters will not be able to login after conversion unless they enter upto eight characters only.

[Sajith P V]

sorry..
run /usr/lbin/tsconvert - c instead of /etc/tsconvert -c

[Bill Hassell]

> run /usr/lbin/tsconvert -c

The reason that SAM is preferred is that this command will indeed convert to Trusted but expires *ALL* passwords. If you use this method, you must follow the conversion with:

/usr/lbin/modprpw -V

NOTE: That is a capital V not lowercase v.

[rajesh73]

Hi Bill

If iam suppose convert to trustmode my root password is disabled?
What can I do?

[Dennis Handly]

>my root password is disabled?

Logon from the console.
Also, have multiple windows to the machine and use one to test while staying on root with another.

[Johnson Punniyalingam]

>>If iam suppose convert to trustmode my root password is disabled?
What can I do?<<<

Looks like you assume ? I am right ?

If yes, you need boot the Server single user mode

Interput ISL> hpux -is
> bo pri

# /usr/lbin/modprpw -k root (enable root account)

or

# cd /tcb/files/auth/r
# vi root

pwd "filed" erase

[Raj D.]

Rajesh,

>if root password is disabled?
What can I do?

keep few root session open :
And you can alaways enable the root password using #/usr/lbin/modprpw -k root