Is my system trusted ?

[marc seguin]

I'm on charge of a new machine and I don't know if iti is a trusted system or not.
The /tcb/files/auth/* directories exist (are they deleted when untrusting a system ?)
But in the /etc/passwd file, encrypted passwd still exist. Shouldn't they be removed on a trusted system ?

So, how to know if the system is trusted ?

thanks.

[Alan Casey]

If you can access the following:

SAM / Auditing and Security / System security Polocies.

Then you are dealing with a trusted system for definite!

[eran maor]

Hi

you can check it with SAM .

also you can cat the /etc/passwd - if your system have ****** in the passwd file that mean that your system is truted .

another way is to see if you have files in : /tcb/files/auth/

you can also see this answer :

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xc2ecd211e18ad5118ff10090279cd0f9,00.html

[Kurt Beyers.]

Have a look in the /etc/passwd file.

If all the passwords are a *, you are running in trusted mode (e.g for a ora817 user):
ora817:*:105:103:,,,:/home/ora817:/usr/bin/sh

If the password is some encrypted text, you're not running in trusted mode:
ora817:h7FZmrWC7Ou.I:105:103:,,,:/home/ora817:/usr/bin/sh

Kurt

[Craig Rants]

Use the command /usr/lbin/getprdef

System is not trusted will appear if such is true, otherwise you will get a little a much different output.

Look at the return codes if you want to script this.

GL,
C

[Sanjay_6]

Hi Marc,

If you login into a trusted system. After displaying the messages regarding checking disk quotas and copyright, it displays the time and terminal from where the last successfule and unsuccessful login was attempted. Or something like that. This message is not displayed on a untrusted system.

Hope this helps.

Regds

[marc seguin]

That's what I was saying, Eran and Kurt : I have the directory /tcb/files at the same time as encrypted passords in file /etc/passwd !
So who to believe ?

Using SAM, or the command getprdef, it seems it is a trusted system.
So why passords are still in /etc/passwd ?????????

[Craig Rants · Accepted solution]

I don't have a good explanation on why there are passwords in /etc/passwd, but here is what I would do.

/usr/lbin/tsconvert ???r to unconvert from command line

/usr/lbin/tsconvert ???c to convert from command line

for i in `cat /etc/passwd | awk -F: '{print $1}'`
do
/usr/lbin/modprpw -V $i
done

What does /etc/passwd look like then.

MC,
C

[Helen French]

hey,

Normally, If any of the /etc/passwd users are also in the shadow password file at the time the pwconv was done, they are not converted.To convert the encrypted /etc/passwd user passwords, remove them from
shadow passwd prior to running pwconv.

HTH,
Shiju

[Helen French]

hey,

See this for more info:

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=220fa6870ebc87f54e/screen=ckiDisplayDocument?docId=200000024602510

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=72d087a40e61f1d974/screen=ckiDisplayDocument?docId=200000024602673

Shiju