Untrusting A Trusted System

[Clay Jordan]

I am upgrading a trusted server to new hardware and would like to untrust it to make it easier to oonvert users and groups. This is my first time working with a trusted system and I have never untrusted a server before but have heard some nightmares about it ? Any experience on doing this at 11.11 ?

[Jim Mallett]

I believe the supported (HP) method of converting it is within SAM:
Auditing and Security -> Audited Events -> Actions -> Unconvert the System


I have only done it once and I used the command line: tsconvert -r

Jim

[Jim Mallett]

Sorry, I believe the tsconvert is under lbin, so it should be the full path:
/usr/lbin/tsconvert -r

Jim

[Bill Hassell · Accepted solution]

An important note: A Trusted system allows very long passwords so when you un-trust the system, those users will have their passwords broken. You can identify these logins in the /tcb/files/auth directory. In each file under the single letter directories, you can grep for: u_pwd and looking for encrypted strings that are longer than 13 characters. These accounts will need passwords reset.

[twang]

To convert to non-trusted systems from trusted systems:
1. login as root
2. execute the command:
# /usr/lbin/tsconvert -r
3. verify that the /etc/passwd file is returned to normal (no '*' in passwd position)
4. verify that the /tcb directory does not exist

Of course you may do it using SAM tool.

[Michael Tully]

One further important note. Be aware that when you trust a system again, all password will expire immediately.

[Bharat Katkar]

HI,
Well to untrust the system use:
# /usr/lbin/tsconvert -r
For more details about TCB administration the doc attached.

Regards,

[Clay Jordan]

Thanks to all for your help