trusted and shadow password

[Elena Leontieva]

Hello,

The Shadow Password is installed on the server running HP-UX 11i v1. We are going to convert the system to Trusted mode. Does Shadow Password work in trusted mode?

Are there any known issues with Hp-UX Secure shell A.04.40.006 in a trusted mode?


Thanks,
Elena.

[Steven E. Protter]

Shalom Elena,

The conversion from shadow password to trusted mode may fail. If it does, you may need to get shadow password out before going trusted.

Shadow password gets the password out of the /etc/passwd file into a file called /etc/shadow.

Trusted system takes the passwords and puts them into a single file for every user in the /tcb folder.

Its more secure than shadow but may not be compatible.

SEP

[Patrick Wallek]

You will have to turn off the shadow password and then convert to trusted.

The 'pwunconv' converts back to a regular /etc/passwd file (no /etc/shadow). From there you can convert to a trusted system.

[Peter Nikitka]

Hi,

note, that you will loose password aging information of /etc/shadow - you'll have to setup this as new on your trusted system!

mfG Peter

[Bill Hassell · Accepted solution]

The shadow password product is incompatible with a Trusted system. You have to choose one or the other. A Trusted system has more security features but requires a separate database (/tcb directory) to store all the attributes and settings.

[Elena Leontieva]

Yes, that is what I thought ... and I did the following:
pwunconv
reboot
swremove ShadowPW

Note that swlist still shows the Shadow Password bundle even though the ShadowPW is not on the system. I feel the removal of the Shadow Password software is a kind of flaky.

Thanks for your help.
Elena.