/etc/passwd after bastille

[hydrocct]

I often copy one system's /etc/passwd to another system to synchronize the user databases. Now one of these systems has been secured using bastille and is now trusted. How can I resynchronise that system's user database with the un-secured systems. In other words, how can I regenerate the /tcb/files/auth/... files from a regular untrusted /etc/passwd file.

[Patrick Wallek]

There is really no easy way, that I know of, to sync trusted and untrusted systems. You really should just make both systems trusted. Then you can copy /etc/passwd and the /tcb structure to synchronize the 2 systems.

[A. Clay Stephenson · Accepted solution]

You can run the tsconvert command which will take the standard /etc/passwd and convert the system to trusted. Alternately, you can copy /etc/passwd, /etc/group, and the entire /tcb/files tree.

Aa always when editing files like these, have copies and be logged in as root in at least two sessions so you can get yourself out of trouble almost as fast as you got yourself in.

[Robert Fritz]

Also note that as more features (like logging) move into standard mode, trusted becomes less necessary. Bastille, in general, only converts to trusted when it has to because of a requested feature.