How to check if a system is trusted or not?

[dictum9]

hp-ux 11.23 presumably

ten_points

[A. Clay Stephenson · Accepted solution]

Check to see if you have a /tcb directory. The system does it via the iscomsec() system call which checks to see if /tcb/files/auth/system/default exists so this is really the test that you should do. Man 2 iscomsec for details.

[IT_2007]

check /etc/passwd for 2nd field and if it is * then it is trusted.

check /tcb/files/auth/system directory.

[DCE]

If the directory /tcb exists, it is probably trusted.

also, the /etc/passwd file will not contain any encrypted passwords.

Finally, SAM auditing asecurity will not work unless the system is trusted

[A. Clay Stephenson]

Wrong Answer:
check /etc/passwd for 2nd field and if it is * then it is trusted

This means nothing. '*' in the passwd hash field of /etc/passwd, by convention, means that the account is locked on an untrusted system. At best '*' means that the system MIGHT be trusted.

[dictum9]

In a nutshell

has /tcb directory = trusted


does not have /tcb directory NOT trusted

Correct?

[A. Clay Stephenson]

The nutshell is almost always correct; however, do the same test that the system does and check to see if /tcb/files/auth/system/default exists and you and the OS will always agree that the system is trusted or not.

Again, man 2 iscomsec and READ it this time.

[dictum9]

OK, that's pretty straightforward.

[sajeer_2]

type
/usr/lbin/getprdef -r

or

Try man iscomsec (to get further information)


sajeer

[sajeer_2]

See this link

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=11108

[Bill Hassell]

Or with a shell command:

[ -f /tcb/files/auth/system/default ] && echo "System is Trusted" || echo "No, system is not Trusted"

[inventsekar_1]

/usr/lbin/getprdef -r

in a not trusted system(11.11),
"System is not trusted."
in a trusted system(11.23),

#/usr/lbin/getprdef -r
NO, 0, 8, 182, 196, -1, 7, YES, YES, NO, NO, NO, YES, 3, 10, 2, 0

i tried man getpredef
no manuals.

1)then how to find out the other options for getpredef??
2.)what information is getprdef returns? what is meant by the above output?

[inventsekar_1]

Hi /etc,

if the system is already converted to trusted one,

# /usr/lbin/tsconvert
System has already been converted.

if the system is not trusted,
# /usr/lbin/tsconvert
this command will convert the system into trusted one. (be careful. it wont ask yes or no before converting)
some method is there to unconvert. i will post that soon.

[nibble]

use the command "tsconvert" or verify the /etc/passwd, it should have a * in the password field if its trusted already

[Jaime Bolanos Rojas.]

Simplest way to me, check for the present of a /tcb directory, if it exists, then the system should be trusted.

Regards,

Jaime.