Encrypted password on Trusted system

[Dewa Negara_4]

Hi All,

I noticed that on my Trusted system, I found there is an encrypted password instead of "*" under /etc/passwd. Below is an example :

[root@bdhp4270:/tcb/files/auth/a]
# more ap1030
ap1030:u_name=ap1030:u_id#8892:\
:u_pwd=11A3o8g6QY.Ko:\
:u_auditid#1237:\
:u_auditflag#0:\
:u_succhg#1107143764:u_suclog#1109657918:u_suctty=pts/te:u_lock@:\
:chkent:

[root@bdhp4270:/tcb/files/auth/a]
# cat /etc/passwd|grep ap1030
ap1030:11A3o8g6QY.Ko:8892:1:Dewa negara:/home/ap1030:/bin/sh

Anyone can help to tell me what is the root cause for this issue? I think it suppose to be "*" on the second field of ap1030 in /etc/passwd. Why does it replace by the encrypted password?

Please help. High score will be given.

Thanks and Best Regards,
Dewa

[Ranjith_5]

Hi Dewa,

You are looking at a tcb file.

do cat /etc/passwd and there should be a * in the password field.

Regards,
Syam

[Henk Geurts · Accepted solution]

strange!
what happens if you change your password?

run
# pwck -s
what's the output ?

regards.

[Dewa Negara_4]

Hi Syam,

Thanks.

That's my issue. I found the encrypted password instead of "*" on the second field of ap1030 uerID.

I need to know why this happen.

Thanks.
Dewa

[Ranjith_5]

Hi,

Is this happening for only one user or even for root user u have the same issue?

regards,
Syam

[Dewa Negara_4]

Hi Syam,

yes...some userIDs including root also affected.

Thanks.

[root@bdhp:/tcb/files/auth/r]
# more root
root:u_name=root:u_id#0:\
:u_pwd=53.LMrmvv3kng:\
:u_bootauth:u_auditid#0:\
:u_auditflag#1:\
:u_succhg#1108070754:u_unsucchg#944597629:u_llogin#0:u_pswduser=root:\
:u_suclog#1109664021:u_suctty=console:u_unsuclog#1109279069:u_lock@:\
:chkent:

[root@bdhp:/tcb/files/auth/r]
# cat /etc/passwd|grep root
root:53.LMrmvv3kng:0:3:SYSTEM (Super User:/root:/sbin/sh

[Ranjith_5]

Hi Dewa,

can you make your system trusted via sam.
If it is already trusted make it untrusted and again make it trusted. This wont require much time.

By the way this found to be a strange problem.

Regards,
Syam

[Darren Prior]

Hi Dewa,

Do you have any 3rd party software that may not be aware that the system is trusted? The only instances of encrypted passwords in /etc/passwd on a trusted system that I've seen were caused by either 3rd party s/w or someone manually editing the file.

An authck -pv is good for checking the health of /tcb.

regards,

Darren.

[Ranjith_5]

Hi Dewa,

Please install Bastille Security Tool on your system and run it. There are options for removing encrypted passwords from the system.

You can download bastille software from http://www.software.hp.com

This is a free software.

Incase you need the installation procedure pls reply.

Regards,
Syam