Converting to Trusted system - Precautions ?

[Shouvik Basak]

I need to convert some production servers to trusted systems. I have various applications running on them which use the Unix password for authentication from their frontends.

I believe the passwords of all users will be expired moment I convert to trusted. As the users do not login directly (they use frontend of the application to login) to the servers this is becoming a major concern for me.

Any suggestions on how to plan forward and what are the things to consider for converting to trusted will be highly appreciated. As these are production servers having hundreds of users I want to be sure everything is planned right before performing any change.

This conversion being a mandate for security reasons, I do not want to convert back to non-trusted as this would not help me in long run :-)

Thanks for your help.
-Shouvik

[Steven E. Protter · Accepted solution]

Shalom,

Notify the user community in advance. Run a passwd -sa report and see who is going to be nailed by then new, tighter rules.

If the user has changed passwords within the default guidelines of trusted systems, their passwords should not be expired.

The real issue is informing your help desk and making sure the user community is well informed.

SEP

[Bill Hassell]

If you use SAM to convert to Trusted, the passwords will not end up expired. This only happens when you use the unsupported command tsconvert. As mentioned, you can run modprpw to reset the expiration dates after running tsconvert (both commands reside in /usr/lbin)

However, you MUST validate your apps on a test system before the conversion. Despite Trusted HP-UX being available for more than a decade, there are some archaic techniques that play around with the passwd file rather than using PAM or mainstream authentication methods. So the big unknown will be the apps and not the users. Unless you or your staff wrote the code for the frontend processes, that will be your biggest risk.