Commands or Procedures to Examine Security Policies

[Donald Osbourne]

I am running HP/UX 11.0 with Trusted Host security turn on. Other than using SAM, how can I locate and view the files containing the policy settings? The security Auditors are looking for the file names and/or commands that will provide the following info:

General Account Policy, Password Policy on Initial Login, Aging, Time between Change, Maximum Fail Login Attempts and Restricting Root login to the system consoles only.

I thank you for any assistance you can give in uncovering the mystery of Trusted Host and any useful commands that will provide a quick glance at the policies and configuration in force.

Thanks
Don

[RAC_1]

man getprpw.
The trusted database is under /tcb directory.

e.g.
/usr/lbin/getprp -m liftm "user_name"
Will give you the lifetime(days) of the usser user_name

/usr/lbin/getprpw user_name will all details.

Anil

[Steven E. Protter]

These policies can be provided to the auditors by screen printing the sam screen of the items you just mentioned.

Take the screen print as you check or set these policies. Thats the way I make our auditors happy.

In the case of root restrictions, print out the configuration file involved. If the auditors know nothing about HP-UX you may wish to provide them the pages from documentation HP-UX Security in this case or itrc that explaints the configuration files.

SEP

[Sridhar Bhaskarla]

Hi Don,

I understand that these systems are trusted so

'getprdef' and 'getprpw' can be used to gather the information you are looking for. The corresponding information is in /tcb/files/auth// for individual users and /tcb/files/auth/system/default for systemwide parameters. /etc/passwd and /etc/group files are flat files that will have uid,gid,home, shell entries. last and lastb commands along with /var/adm/su.log and /var/adm/syslog/syslog.log can help identify the successful/unsuccessful login attempts. /etc/securetty determines root's direct login from other than console/CDE. /etc/default/security file will have additional security options. Look for .rhosts, .netrc in each users' home directory and /etc/hosts.equiv for backdoors.

The above are some of the tools/files that may help you in tightening user security. Try "Bastille" that can help you report and configure any security issues in other areas.

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

-Sri

[Donald Osbourne]

Thanks guys, the getprpw seems pretty useful. I will have research the options that will get me all that I need.