Trusted Systems

[ralph barber]

We have recently started converting our HPUX 11.00 systems
to Trusted Systems however on converting the first two systems we found that about 20% of our users when they first logged in were prompted for their old password however when they entered it they were told there was no record of their old password and the connection was terminated. Does anyone know what causes this and how it can be avoided in future conversions.

[RAC_1]

when you convert to trusted mode, all passwords get expired. so user will be prompted to entre for new password. To avoid this execute
/usr/lbin/modprpw -V after converting to trusted mode.

[ralph barber]

Thanks Anil that's handy to know - still curious to know why so many users did not have their old passwords recognised.

[Michael Steele_2]

Here are some more basic trusted system commands:

authck -p (* verifies the integrity of the protected trusted password file in /tcb *)

getprpw (* alock = yes then disabled account *)

modprpw -a alock = NO (* to unlock disabled account *)

[RAC_1]

run pwck and grpck befre converting. Also authck after conversion.

[ralph barber]

We did run pwck and grpck before conversions
nothing untoward found

[Darren Prior · Accepted solution]

Hi Ralph,

There can be issues with password greater than 8 characters when the system is converted. This may account for your 20% of users having the problem.

regards,

Darren.

[ralph barber]

Thanks that would make sense as I know quite a few of our users were using passwords longer than 8 characters

[Steven E. Protter]

If you haven't been using password aging or your password aging is greater than 60 days, when you go trusted, the default password age is 60 days.

Any user with a password over 60 days old gets expired.

Hence the problem.

As far as there being no record of the old password, that should not happen.

SEP

[Darren Prior]

Re: passwords over 8 chars.

I believe if they had entered just the first 8 chars of their long password they'd be able to change their password.

regards,

Darren.

[ralph barber]

Stephen
We did have password aging set to 28 days so that wasn't the issue in our case