Re: Openssh v4.2-3 vs. HP-UX 11iv1 TCB

Hi Bob,

HP does a great job in porting OpenSSH to HP-UX. It is available as "HP-UX
Secure Shell" for free (http://software.hp.com). I would recommend you using
this package.
You can download it here:
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

There are a lot of other OpenSource tools portet by HP these days. No need to go
thru the pain of compiling these yourself. Look out for the "HP-UX Internet
Express" collection.
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111


-Markus-


Quoting Bob Jones <bob.jones@xxxxxxx>:

Hello all. For various reasons, we use a version of openssh (currently
v 4.2) that is built on a system running HP-UX 11iv1 that has not been
converted to TCB, but we wish to run it on a system that has been
converted to TCB. We have noticed that when run this way sshd is not
updating the last login (u_suclog) field in the TCB and that it doesn't
honor administrative locks on accounts (lets you log in anyway).

We can get around this by using pam (UsePAM=yes) but this is not the way
we would prefer to get around this problem.

I've done a number of searches trying to find solutions to this issue,
and the only one I have really come across is to use pam.

So, here are some questions that hopefully some of you can help us out
on with answers.

1. If you compile Openssh on a HP-UX 11iv1 system that has been
converted to use TCB, does Openssh properly update things like last
login in the TCB and honor locks set in the TCB?

2. Is there a compile time and/or config option we can set to force
Openssh to honor the TCB on a system that has not been converted?

3. Is it possible to compile openssh in such a way so that the single
sshd binary will honor both TCB and non-TCB systems?

Thanks for your help!

--
Bob Jones
bob.jones@xxxxxxx
OIIT, The Board of Regents
The University System of Georgia


Relevant Pages

  • Openssh v4.2-3 vs. HP-UX 11iv1 TCB
    ... For various reasons, we use a version of openssh that is built on a system running HP-UX 11iv1 that has not been converted to TCB, but we wish to run it on a system that has been ... We have noticed that when run this way sshd is not updating the last login field in the TCB and that it doesn't honor administrative locks on accounts. ... If you compile Openssh on a HP-UX 11iv1 system that has been converted to use TCB, does Openssh properly update things like last login in the TCB and honor locks set in the TCB? ...
    (SSH)
  • Re: openssh-3.4p1.tar.gz trojaned
    ... I just upgraded my OpenBSD 3.0 machine to OpenSSH 3.4 last night. ... * Blowfish input vectors are handled incorrectly on HP-UX PL.2 systems. ...
    (FreeBSD-Security)
  • Re: OpenSSH-3.5p1 with PrivSep, user login fails, root login works
    ... >HP-UX 11.0 system in standard configuration) should be ... >reported/documented as a bug in OpenSSH? ... HP-UX should be listed as "privsep doesn't work there" in the OpenSSH ... >From what I understood of the OpenSSH code, it does a perfectly standard ...
    (comp.security.ssh)
  • Performance improvement in OpenSSH 4.0
    ... transfers after upgrading my system to OpeSSH 4.0(running on HP-UX). ... OpenSSH 4.0 and Is there any addtional ways to improve the performance ...
    (comp.security.ssh)
  • Re: openssh-3.4p1.tar.gz trojaned
    ... > I just upgraded my OpenBSD 3.0 machine to OpenSSH 3.4 last night. ... > * Blowfish input vectors are handled incorrectly on HP-UX PL.2 systems. ... > * Perform routine compatability checks. ...
    (FreeBSD-Security)