shadowing /etc/passwd

[John_608]

I am running d class server with hpux 10.20 how do i shaddow the password file tsconvert does not seem to exist as in hpux11

[Patrick Wallek · Accepted solution]

tsconvert does exist in HP-UX 10.20. It is in the /usr/lbin directory.

[John_608]

do i simply run this as i do in 11.X

[melvyn burnard]

Yes
But the BETTER way is to run it from SAM, as there have been known issues with running the manual command

[Patrick Wallek]

Yes. It works pretty much the same as in 11.

[Darren Prior]

Hi,

Please ensure your system is well patched BEFORE you run tsconvert. The supported way to convert the system is via SAM, which of course uses tsconvert.

There are a number of trusted system patches that you must have otherwise tsconvert can cause problems.

regards,

Darren.

[John_608]

can someone please tell me patches are needed as this machine is not patched.

points to be awarded at end.

thanks
john.

[Darren Prior]

Hi John,

at the very least you need:

PHCO_8246
PHCO_8247
PHCO_17218
PHCO_22768

and the following SAM patches:

PHCO_12236
PHCO_22268

You must also realise that there are many other essential patches for 10.20 (ie PHKL_16751), and that it is an obsolete, out of support OS.

regards,

Darren.

[Emil Velez]

tsconvert is the trusted systems conversions. the passwords are put in /tcb

HPUX 11.11 supports the true shadow password functionality with pwconv and pwunconv.

I just wanted to make sure you understand that this is not the shadow password functionaity.

Sam can convert a system from trusted mode and back when you go into auditing and security.

Good luck

[John_608]

in hpux 11 tsconvert creates a /tcb directory but i cant see where the files are in 10.20 any help appreciated.

[Darren Prior]

Hi John,

The files are under /tcb at 10.20 too. If you've already trusted the system then /etc/passwd will have asterisks instead of passwords for each user.

It really is better to use SAM to trust the system, it is the supported way and I think it gives you more info if there are errors. Did tsconvert complete successfully, were there any error messages returned, was the return code 0?

regards,

Darren.

[John_608]

Darren i am looking at a converted system. not by me. and there are asterics in the passwd file but no /tcb directory. when tsconvert is run or sam is run can a different directory be specified ?

cheers
John.

[Darren Prior]

Hmmm - and the accounts with asterisks includes non-system accounts? (lp, bin and a few others are normally disabled and so have an asterisk in their passwd field.)

To the best of my knowledge there is no choice of directory for /tcb, so if /tcb doesn't exist then something has gone wrong.

Is the system patched with the tsconvert and SAM patches? Are all the other critical patches installed?

The following command will highlight any unconfigured filesets:
swlist -l fileset -a state | grep -ve configured -e \#

regards,

Darren.

[John_608]

Darren

guess who only looked at the initial part of the passwd file for asterics ! sorry i wasted your time problem resolved.

John.

[Hazem Mahmoud_3]

Just an fyi, but if you want to know if a system has been converted to a trusted system, execute "/usr/lbin/getprdef -r". If it says something to the effect of "your system is not trusted", then you'll know. That's usually a quicker and surer way of knowing.

-Hazem