HP UXi - Shadow Passwords and other questions...

[Aaclof]

Hi all,

I need your help for the following points :

1) I have read many things about shadow passwords and HP UX Trusted Mode. I want to be sure I got it right. To protect passwords, I can either convert into trusted mode (getting individual files only root accessible in a separate file structure), or use shadow passwords (root accessible only)).

Once in Trusted Mode, it is no more possible to use Shadow Passwords, is that right ? According to many threads, converting to Trusted Mode is a better solution than using shadow passwords, do you agree ?

2) As a beginner with UNIX, I am completely lost with PAM and /etc/security for password policies. I think PAM is available on HP UX operating systems. Pam_cracklib module gives a way to create password policies, but is seems more difficult than simply using the security file. What happens when I use both ? Which one has precedence ??

3) I would like to password protect boot in single user mode. I know it is possible with Trusted Mode. My question is : how can I define the password and who can start as single user ? Do we need to be root or not ?

4) How can we make sure than use of su command are logged in HP-UX. I heard of /adm/var/sulog file. Is it always present on systems ? Can we create it if it is not ?

5) Is it possible in HP UX to deactivate a service by commenting the corresponding line in inetd file, or not ?

6) What command line should I use to look for all .rhosts file on my system ? I found find /home –name .rhosts –print. Does it work on HP-UX ?

Thank you for your help ! Do you know similar forums for other UNIX operating systems ? I am trying to learn as much as I can and forums seem to be the best way to do it.

Aa

[Devender Khatana · Accepted solution]

Hi,

1. Trusted mode will always be a better option them other security measures as it provides some additional features.

3. Once converted to trusted system, you can go to single user mode only with root password, you can not set seperate password for this.

4. Just do a su by some user and see if it is getting logged to /var/adm/sulog. Yes it is always enabled. ( So far was not required to enable it anywhere)

5. Yes, services with commented lines will not be executed.

6. Yes this find command will work in HPUx also. Instead of /home search it in / as root 's home is not in /home.

For any other Unix we do not have such nice forums. Still there are plenty but others will provide links as I do not use anything except this.

HTH,
Devender

[Aaclof]

Thanks...

What do you mean exactly with your answer at the sixth question ? That I should type something like : root# find / ... ?

For the su logging, do you know how I can disable it (and then reenable it if needed) ? Is there a config file somewhere that I need to comment or uncomment ??

Thanks for your help again. If others could confirm it or give their points of view, that would be perfect.

[Victor BERRIDGE]

Hi Neighbour,
I will go through what will/may generate issues...
1) Of course Trusted is far more secure than shadow
but 3)
I wonder why you would do this? normally a box is in a computer room where only authorized persons may enter, no? This is - if you have allowed root connection only from the console...
Now lets say you are in trusted mode- AND some clot has decided to see if he could crack the root passwd, it will not take long before root login be deactivated... Here you would run down to the computer room already quite stressed and be happy to find you can still connect yourself at the console, if your are unfortunate because someone else had the passwd and changed it before and has told you nothing about it. Then even the console will be of no help unless you granted another account to be allowed to reboot so adding passwd protection for booting in single user is only to make the sysadamin life harder when he would be in need of some some of comfort...(clean shutdown and at the console go single user wihout any other nuisance in order to be concentrated on the issue he is trying to solve)...
There are many way to tighten your box...
what are you trying to achieve?

All the best
Victor

[Bill Hassell]

1. The shadow password file is the classic (and not very secure) methoid to hide the encrypted passwords to prevent easy access with crack and other password guessing programs. If you have any requirement for a secure system, use Trusted. Not only are the encrypted passwords hidden from users, but you have a very large number of controls available for password choices and other security features. Trusted is much better than shadow passwords.

2. PAM is the aythentication method for 11i and higher. Version 11.00 implemented some authentication with PAM but the conversion is complete only in 11i. /etc/security does not exist in HP-UX. The file is /etc/default/security and has almost no effect for a standard system, a few controls are active in a shadow password system, and virtually all the lines are available in a Trusted system. Use the command:

man security

to read about this file. The man page for pam (and related pam subjects) gives information on how to integrate other modules...I have no idea if pam_cracklib will work on HP-UX. A search of the net shows a few experiments but no solid directions on how to set it up. If you use a PAM module, it will override the built-in Trusted system features for password format. SAM can configure many of your password policies both at the user level as well at the system level. The /etc/default/security and the values listed in SAM for system and users all work together.

3. Single user mode can require a password. Since single user mode is unlike a normal Unix environment, there are no users (directories like /usr and /home are unmounted) so there is only one login possible: root. As far as getting into single user mode, the commands init s and shutdown 0 do not reach single user mode. Only a complete reboot and interaction during the boot process will get to single user mode. Naturally, there is no networking during bootup and in single user mode so all of this must take place on the real console. Only root users are allowed to shutdown the machine unless you have made special provisions in /etc/shutdown.allow file.

4. As mentioned, su always logs it's activities and always creates the sulog file if it does not exist. However, su is not the tool of choice for a secure and autdited system. The sudo command (a contributed program) is much preferred.

5. Yes.

6. Yes, your command works but it will be VERY slow depending on the size of /home. Since .rhosts is useless unless it is in the user's $HOME directory, there is no need to search thousands of subdirectories for an ineffective file. Just use this:

ll /home/*/.rhosts

Of course, if you disable the 'r' services (remsh, rcp , rlogin) then it really doesn't matter if someone has a .rhosts file. See more information about ssh to eliminate the 'r' commands.

If you need a definitive tool for cnofiguring all the security features on your HP-uX system, downloaad copies of the following products from HP:

Bastille
security_patch_check
sudo
Secure Shell (ssh)

Note that Bastille is also available from HP for Linux. Note also that Bastille currerntly requires an Xwindow display to run. The others are standard Unix command line tools.

[Aaclof]

Hi all,

Thank you for all your answers. I have one last question, which will be very easy for you.

I would like to know how to disable one user account with HP-UX (especially in Trusted Mode), without using SAM.

With Linux or Solaris I think you can simply add a * or comment a line of the /etc/passwd file. Will this work on HP as well ?

Is it possible on a UNIX system to disable one group of users (to prevent someone from adding new users in it ?).

Thanks again,

Aaclof

[Devender Khatana]

Hi,

Yes, it will work in HP as well. I recommend to use passwd command to do this for you.

#passwd -l test

from a super user will do this.
Allthough by again assign a passwd for this user will make this user account available.

I do not think there is something like disabling groups. We can only disable users not groups.

HTH,
Devender

[Bill Hassell]

How to disable a login depends on whether your system is Trusted or not. Like all standard Unix systems, you can disable a login by replacing the password field with something that is impossible to be a password. The algorithm for encryption always creates a 13 character string, so 12 or less characters will work fine (including * which is just traditional). You can have any of these to disable a login:

billh:*:
billh:GONE:
billh:DISABLED:
billh:nologin:

and so on. I prefer all UPPERCASE so a disabled account stands out. For a shadow password system, all the password fields are * which is just a placeholder. The real passwords are in the hidden password file. For a Trusted system, it is the same (* in /etc/passwd) but each user has their own security file in the /tcb directory. For shadow and Trusted, you can use the hidden command /usr/lbin/modprpw to disable, enable or perform other maintenance.

As far as restricting a particular group, no one can modify the /etc/group file except root. Change the root password for users that are not sysadmins, or look at using sudo to restrict access to specific commands.

[Aaclof]

Ok,

Thank you.

So, for a non-trusted HP UX, I can simply use the command mentioned above or add a * (or anything else) to the /etc/passwd file.

For a UNIX system using shadow passwords, eg Linux or Solaris, I need to edit the shadow file, since the * is already in the /etc/passwd file.

Finally, for a Trusted Mode HP UX, I need to edit the tcb/... files.

For the last two cases, would the command work or not ?

Thanks for your help and for your time.

You can give me answers that take hours to find on the web

[Victor BERRIDGE]

Hi again,
For HPUX:
Trusted you can edit but it is not wise!
As bill mentionned use modprpw :
# /usr/lbin/modprpw -l -m alock=YES fza
To check what you have done
# /usr/lbin/getprpw -r -m lockout fza
will display:
0000010
check with non disabled user to see the diff...
To enable:
# /usr/lbin/modprpw -l -k fza
to check...
# /usr/lbin/getprpw -r -m lockout fza
It displays
0000000

But you could also:
passwd -l

from the man pages:
-l Lock user account. In untrusted mode this replaces the
encrypted password with *.

...

All the best
Victor

[Victor BERRIDGE]

Oops
fza was my cobbaye (test) user (well he wasnt connected at the time...)
so you should read


All the best
Victor

[Steven E. Protter]

1. Yes, shadow passwords and trusted mode do much the same thing. trusted advantage is there are many password files, which makes it harder to grab one file quick and try and crack it at home.

2. Yes pam is available. You don't have to do anything to activate it. Keep up with patches though.

3. You do that with sam. When setting up restricted sam, don't let anyone but root change these settings.

4. sulog is a standard feature. I just checked one of my systems. I didn't do anything to set it up.

5. Yes

6. find / -name *rhosts

SEP

[Bill Hassell]

The simplest method for ALL system (un-trusted, Trusted or shadow) is to always use passwd -l since passwd knows how to do it correctly. Editing passwd, the shadow password file or the /tcb file is always risky. Just let passwd do all the work.