trusted or non-trusted

[public]

We know the way to configure C2-level HP-UX trusted system either using SAM or tsconvert command.

The thing is how to determine the HP-UX system is in trusted or non-trusted mode?

Any good idea?

[V.Tamilvanan]

Hi,

There r so many ways to check. some of them

1.The /tcb Directory will be there in Trusted system.


2. When u log on to Trusted system it will display like the "Last successful login for root: Fri Jun 6 05:51:35 SST-8 2003 on pts/tb
Last unsuccessful login for root: NEVER "

HTH
-tamil

[Rajesh G. Ghone]

Hi,

The easiest way to findout is to see /tcb directory if this directory is not available then it is not in a trusted mode or you can see in /var/adm/syslog/syslog.log the login information.

Regards,
Rajesh G.

[public]

Hi Tamil and Rajesh G,

Thanks for reply.
The ways you provided are good to show the system is in trusted mode. But is there any "official" way to achieve this? Maybe using a command, a log file, or something else...

[Stefan Farrelly]

tsconvert -p

If the system isnt trusted it says cant convert.....on non-Trusted system

If the system is trusted it says; At and crontab files converted.

[Stefan Farrelly]

or even better;

/usr/lbin/getprpw

If the system isnt trusted it says so.

If it is trusted you get a Usage: [options....] message.

[Balakumar M]

Hi,
Check this link

http://docs.hp.com/hpux/onlinedocs/B2355-90121/B2355-90121.html

-Bala

[V. V. Ravi Kumar_1]

Hi,
just type
/usr/lbin/getprpw
if it is trusted it displays help, it is not trusted it displays
System is not trusted

Regards

[Darren Prior]

Hi,

There isn't an official way that I know of to tell if a system is trusted, other than going into the "Auditing and Security" menu of SAM. From there if you try to enter any of the Audited sections you'll either be prompted to trust the system or you'll be shown the Audited events/users, etc. Unofficially I'd check for /tcb; and especially the presence of /tcb/files/auth/r/root.

In addition the only supported way of trusting/untrusting the system is by using SAM, even though it uses tsconvert itself. The modprpw/getprpw commands are themselves only supposed to be used by SAM, and in fact are only documented at 11i. If you use them, bear in mind that their functionality could change in later releases.

regards,

Darren