Keeping loginoid as password

[Shibu_2]

Hello all


Any one please help in keeping the exact loginoid as password in Hp 11.0 Trusted System.
This is required for application purpose.


regds
Shibu

[Elmar P. Kolkman]

As I understand, you want the loginname and password being kept the same for some users. Not really secure, but I think it can be done. If you use SAM and modify the user account you can select an option in the password options item: 'Allow only super-user to change password'. This should do the trick.

But I'm not really sure if this option is available on a trusted system, since I don't have any in my network. It should work according the manual page, but I can't try for myself.

[Hoefnix]

If you mean you want to have user-account with a password thats the same as the login-id?

This is normally not allowed in a Trusted system, but i think you can overrull this by using the tool cryptpw.

cryptpw login-id will give an encrypted string.
This string you can type in the shadow password file of the specific user.

I do not have a trusted system but the shadow password files are somewhere in /tcb/...

Hope this works.

[Alan Turner]

As root, you should be able to set the password for a user, e.g. "appuser":

passwd appuser

(when the prog asks for the password options, enter 'p', to pick a password, then you can enter a password of your choice). I don't know if the password validation routine will reject a password the same as the user name, or lacking digits etc. If so, you could try using SAM to change the password validation rules. Another option would be to try getting an encrypted password on an un-trusted system, then editing the trusted machine's password file (/tcb/files/auth/a/appuser, for the example).

[Jeff Schussele]

Hi Shibu,

I would have a talk with this App vendor or developer. They're asking to break one of the first rules of security. One *never* wants a username & PW to match. Why? Because all a maliscious user or hacker would need is access to the system to login & stop or corrupt the application. If they discover that user name, they can effectively control or destroy that application.
So even if you could do this, I wouldn't.

My 2 cents,
Jeff