HP-UX

Hi,

In my HP-UX, when I used cat /etc/passwd,

ferdaus:*:198:20:ferdaus,pbapp,04-2013186,:/home/ferdaus:/usr/bin/sh
pbapp:*:110:20:superadmin,penang,,:/home/pbapp:/usr/bin/sh

May I know why * is in password part? There is no /etc/shadow files.
Can I revert back /etc/passwd to show an encrypted password not an *.
Can you guide me step by step to do it?

Thanks,

hi...

If the password is an * (asterisk), the user cannot log in. The value is a character string. The default value is *.

The system may be in trusted mode. Naturally, we were not told which version of HP-UX. I will assume it's 11i. An 11i in trusted mode will have a hierarchy called /tcb/files/* present and the real passwords are there. Untrusting is a dangerous procedure and I have never done it. Re-installing the OS might be the way to go. In theory /usr/lbin/tsconvert -r running in single user mode but with all local filesystem mounted should untrust a system.

To complete Perderabo's explanation, HP trusted systems started to use /tcb/files from 10.20 on and in 11.11 you could get a optionnal addon to give the OS this little solaris look (/etc/shadow).

The /tcb/files is far more secure and a more than one DB... So be carefull when playing with it... I had cases where DBAs managed to lockout root account...

If you were in trusted mode why would you want to return to normal?
Is it because accounts are locked?

I need to make in normal mode because right now the unix servers(11i) cannot communicate with BackupExec 11d. It is authentication issue between unix and BackupExec. After communicating with Symantec technical support, they ask to return the etc/passwd as a normal encryption and not * as my first post. Please guide me how to do this because I'm a beginner in Unix.
Thanks,

Ok...

2 options in your case I would choose the first:

1) sam
2) /usr/lbin/tsconvert -r

Using sam:
Once in sam:
go to: Auditing and Security
-> Audited Events
-> Actions -> Unconvert the System.

Hi VBE,

Thanks a lot for helping me. Now my BackupExec can communicate with Unix already.

Thanks all,