Trusted computer base in HP-UX

[Amit Manna_6]

Hi,

Can anybody please let me know how to implement TCB in HP-UX 11.0. Please let me know if there is some good doc on the HP Site.

Thanks and Regards,

Amit Manna

[Joseph Loo]

hi,

a good doc will be:

http://www.docs.hp.com/hpux/onlinedocs/B2355-90121/B2355-90121.html

especially "Setting Up Your C2-Level Trusted System" to setup.

regards.

[Hoefnix · Accepted solution]

Amit,

tsconvert will do the job, but you can better convert via SAM.

Found some doc's but they are for 11i.
http://docs.hp.com/hpux/pdf/B2355-90781docs.pdf

http://docs.hp.com/hpux/pdf/B2355-90782docs.pdf

http://docs.hp.com/hpux/pdf/B2355-90780docs.pdf

Check also some threads on this forum (check TCB) because there are allot points of attention when converting a live system to TCB.

Example:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=112704


HTH,
Peter

[doug hosking]

Also be sure you are current on patches, especially for libsec. Some of the libsec patches are important for minimizing performance impact on the system, especially on large memory/IO configurations.

[John Carr_2]

Hi

make sure your root password is not longer than 8 characters or the conversion program will truncate it in the process and you will not be able to login as root. Ensure when you run tsconvert or through sam you have another root window open in case of problems.

also be aware that after conversion users will be forced to change password unless you issue command /usr/lbin/modprpw -V

you can use the search box at the top of the page to search for tsconvert and find lots of previous psoting on this subject.

john.

[doug hosking]

Actually, the passwords are ALWAYS truncated to at most 8 characters in standard mode. Anything after 8 characters is simply ignored when typed. The conversion process doesn't truncate passwords; it only changes the way existing passwords are interpreted. But the overall point is still valid - be careful if you think you have passwords more than 8 characters. If you set a long password AFTER the conversion to trusted mode, all the characters will be used in the comparison, because trusted mode stores passowrds in a form where there is space for the longer ones. Oh, the joys of backward compatibility...

[John Carr_2]

Amit

also ensure your system is patched for tscovert, HP recommended patch level PHCO_28980

John.

[Bharat Katkar]

Hi Amit,
Find attached the docs for implementing TCB on your system.
Hope that helps.
Regards,