HP-UX Standard Mode Security Extensions B.11.23.02 Release Notes

1 HP-UX Standard Mode Security Extensions B.11.23.02
Announcement
The following information is for the HP-UX Standard Mode Security Extensions for HP-UX 11i
version 2 September 2004 update and later. These security features are included in the
StdModSecExt bundle which contains the TrustedMigration product.
The security features include enhancements or changes to the HP-UX auditing system, passwords,
and logins. In previous releases of HP-UX 11i v2, these features were only supported on systems
converted to trusted mode. By installing the Standard Mode Security Extensions, you can now
have these features without converting the system to trusted mode. More information is given
in “What’s in This Version” (page 9).
The HP-UX Standard Mode Security Extensions in the StdModSecExt bundle can be obtained
from the following locations:
• HP Software Depot at http://www.software.hp.com. Refer to “Installing the HP-UX Standard
Mode Security Extensions Software” (page 13) in this document for instructions on installing
from the Software Depot.
What’s in This Version
The following sections briefly describe the security features of HP-UX Standard Mode Security
Extensions.
• “Features and Benefits” (page 9)
• “Auditing System in Standard Mode HP-UX” (page 10)
• “Configurable System-Wide Security Defaults in /etc/default/security” (page 10)
• “User Database for Per-User Configurations” (page 11)
Features and Benefits
Several security features that were previously available only on systems running in trusted mode
are now available in standard mode without converting to trusted mode. In addition, several
security attributes that were previously set on a system-wide basis can now be configured on a
per-user basis.
The following security features are now available in standard mode:
• Auditing user and system activities.
• Account locking after too many authentication failures occur.
• Displaying the last successful and unsuccessful login.
• Preventing the re-use of passwords in the password history.
• Preventing logins with null passwords.
• Restricting logins to specific time periods.
• Expiring inactive accounts.
These security features are implemented by the following HP-UX changes:
• The auditing system.
• The /etc/default/security configuration file (system-wide security defaults).
• The /etc/shadow password file.
• The /etc/pam.conf configuration file and the PAM libraries.
• The libsec routines.
• The addition of a user database for per-user configuration.
Announcement 9