LDAP-UX with trusted system

[Hirotada Sasaki]

Hello,

I'm trying to use LDAP-UX with trusted system. But users can't login via telnet, ftp, or CDE login. I noticed su and ssh(without public key authentication) works well. Also /usr/bin/passwd can change the password in LDAP server correctly. So I asked HP about this issue. But the answer was "HP doesn't support LDAP-UX with trusted system".
I think there could be some workarounds, since some of the functions work well.
So does anyone have experience to use LDAP-UX with trusted system ?

Best Regards,
Hirotada

[harry d brown jr]

If you are using LDAP, why use trusted?

live free or die
harry

[Steve Steel]

Hi


Are there error messages

example

/var/dt/Xerrors $HOME/.dt/startlog

for CDE


Steve Steel

[Hirotada Sasaki]

Hi harry,

I want to keep user root in local file. But in this case, anyone can see encrypted password for root.
So I prefer trusted system.

[Eric Buckner]

Hirotada,
Not that I am of any help in this situation, but I have been looking at running LDAP-UX for user authentication. Do you have any documentation concerning doing this on a non-trusted system?

So sorry wasn't trying to hijack your tread. Email me at ebuckner@dollargeneral.com and hopefully I won't do to much damage.

Thanks,
Eric

[Rodney Hills]

I am looking into installing LDAP-UX (now that we have a Win2000 ADS server), but I am disappointed to hear it doesn't work with "trusted systems".

Some day I might implement "trusted system", not so much for security, as to get the capabilities to trace events for auditing purposes.

I hope HP is looking into at least seperating those capibilities outside of "trusted systems", because they sure look handy.

-- Rod Hills

[Daimian Woznick]

Have you setup PAM to allow the authentication for telnet, ftp, CDE to come from the directory?

[harry d brown jr]

Hirotada,

I see what you mean. I'll look into somethings.

live free or die
harry

[Sridhar Bhaskarla]

My take is that LDAP cannot be supported on trusted HP-UX because the trusted password database is proprietary to HP so I am not surprized if the standard utilities do not work. I am not sure if HP changed it's stance.

We tried and gave it up. Did you try su/ssh'ing to a normal user from another normal user after changing the password in LDAP?.

-Sri

[Hirotada Sasaki]

Hi Steve,

Here is a error messages about CDE. (~/.dt/startlog wasn't created.)

/var/dt/Xerrors:
# cat /var/dt/Xerrors
X connection to :0.0 broken (explicit kill or server shutdown).
usage: chown [-R] [-h] owner[:group] file ...

Mon Jul 22 11:09:01 2002
error (pid 8964): Session has no command/arguments
/usr/bin/X11/xsetroot: unable to open display ''
mwm: Could not open display.
Error: Can't open display:
Error: Couldn't find per display information
ksh: lpstat: not found
ksh: awk: not found
ksh: sort: not found
PrintSubSystem: (PrintSubSystem) InitChildren method could not list queues.

Are there any idea what's going on ?

[Hirotada Sasaki]

Hi Daimian,

I configured pam.conf so that login, ftp, dtlogin, etc. refers libpam_ldap.1 after libpam_unix.1.
(Actually, I copied pam.ldap to pam.conf.)
Also edited nsswitch.conf to refer ldap directry.

So I think it should work...

[Hirotada Sasaki]

Hi Sridhar,

Yes, I tried to su from normal user A to normal user B, just after user A changed his password with /usr/bin/passwd.
And it succeeded.
Of courese, user A and B are neither in /etc/passwd nor in /tcb/files/auth.

[Bob Neal-Joslin]

There is a similar discussion under the hp-ux/security forum. Look for "ldap and trusted systems". There are more details there.

Bob