/etc/default/security vs Trusted System

[Ray Allen_1]

Hi All,

Hopefully a quick question. We are enabling our HPUX servers to Trusted System. I just wanted to clerify if /etc/default/security is needed with Trusted System, Don't need it at all, or replaced by Trusted System?

I basically want to know if it is needed after converting to Trusted System.

Thanks a million

[Ivan Krastev · Accepted solution]

Yes, security file is used in trusted systems as well.
See managing passwords in trusted mode - http://docs.hp.com/en/B2355-90950/ch08s10.html

regards,
ivan

[Robert-Jan Goossens_1]

Hi Ray,

Have a look at the security manual, it describes for each option if it applies for trusted systems.

11.23 example
http://docs.hp.com/en/B3921-60631/security.4.html

Regards,
Robert-Jan

[Ganesan R]

Hi,

There are many parameters you can set in security which cannot be set on trusted configurations. Like Password history depth,
Number of logins allowed per user, How to behave when user home dir is missing, Password min upper/lower/special characters,
ignorance of /etc/nologin file, etc.

security file will be referred even after the system is converted to trusted.

[Ray Allen_1]

Thanks all. I appreciate your input.

[Bill Hassell]

Your Trusted system will use /etc/default/security if it exists, but it is not required. Instead, it provides extended security features that are very dependent on security patches. The man page for security on your system is the correct reference. If you use the online man page, you'll see options that may not work until you bring your patches up to date. The security file controls all 3 authentication environments: standard, Trusted and shadow password. But the man page will describe which options apply.

The security file has an two undocumented features:

1. The # sign acts as a comment character but unlike almost every UNIX style of comment handling, trailing # signs at the end of an option turn the entire line into a comment.

2. There are no diagnostics. So if you misspell an option or give it an invalid value, you'll not see the error in any log. The only way to see if an option works is to test it.

[Ray Allen_1]

Points and advise well taken.
Thanks.