can I have shadow passwd without tcb

[nancy rippey]

Is it possible to implement password shadowing without going full blown tcb?

Nancy

[harry d brown jr]

I don't think so, well I've not seen it!

Besides, I would not want to rely on the "hiding" of the passwd file as my method of password security. If you really want to do it one better, think of ldap.


live free or die
harry

[harry d brown jr]

Nancy,

http://www.murkworks.net/link_farm/docdir/HOWTO/en-html/LDAP-HOWTO.html

or

http://www.blacksheepnetworks.com/security/resources/security-with-ldap.html

FROM HP:

http://docs.hp.com/hpux/onlinedocs/J4269-90013/J4269-90013.html




live free or die
harry

[Patrick Wallek]

There is no equivalent to Sun's /etc/shadow on HP. The closest you can get is converting to a trusted system which creates the /tcb structure.

Any reason you don't want to convert to trusted system?

[nancy rippey]

Harry,
Thanks for the LDAP links. We are looking at implementing LDAP with our security folks. With 280 HP servers it is slow going.

Patrick,
We are in the process of converting all servers to trusted now but I am a little concerned about losing access with root. I have read various problems in the forums with trusted and being unable to log in as root when various system problems occur.

I spoke with our HP rep. yesterday and he thought that it was possible to implement just the shadow password portion. He is putting me in contact with an HP sec. person.

Thanks!
nancy

[harry d brown jr]

Know the pain, as we have over 500 HP 9000's, and it's a SLOW painful process, but with the temporary ills.


live free or die
harry

[Helen French]

Nancy,
I would recommend switching to trusted. There are many benefits and other features such as password aging, login settings, and not to mention the security benefits.
I too understand the work behind this but if you are smart about it there should not be any real problems converting and it will be better in the long run. You do have to watch out for current password settings on users, they will loose their current setup. If you're worried keep root logged in somewhere while you verify the account.

[Sridhar Bhaskarla]

Hi,

No hastles in converting your systems to trusted.

You can disable most of the features of trusted systems for either root's account or systemwise if you are concerned about losing access to root. Or you can customize the "system security policies" very easily using SAM. Look at "Modify Security Policies" under the Actions menu for each user in "Users and Groups" OR "System Security Policies" under"Auditing Security" section of SAM.

Trusted is the way to go if you want to implement shadow passwords.

-Sri

[doug hosking]

Nancy, see
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=ShadowPassword

[Geoff Wild]

Woohoo:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xe14163f96280d711abdc0090277a778c,00.html

[Uday_S_Ankolekar]

Trusting the server is the best way to have shadow file.
My suggetion to you is have a backup copy of /etc/passwd file before converting to trusted. In case if you face problem then unconvert the server and you have anyway a backup passwd file

tsconvert -r will revert back the sever to untrusted.


-USA..