HP-UX Integrated Login

Integrating DCE with HP-UX Integrated Login

•If you have set up a passwd_export cron job to update /etc/passwd with DCE Registry data, any changes you make to /etc/passwd will be lost when the cron job updates /etc/passwd.

•When DCE is unavailable and HP-UX Integrated Login is configured to fall back to /etc/passwd, if /etc/passwd has been updated with information from the DCE Security Registry, and the first 8 characters of the password a user enters at login match the first 8 characters of that user’s DCE password, then the login will succeed even though the password entered may not be identical to the DCE password. The user will not, however, have DCE credentials.

•If you are logged in to DCE from a foreign cell, note that you cannot use the passwd command to change your password.

•The HP-UX Integrated Login utilities may not work when the system disk is full or disk quotas are exceeded. DCE requires disk space for the creation of temporary files.

•DCE credentials are not automatically removed when the user logs out. The administrator can set up a cron job to remove credentials when users log out as described in “Removing DCE Credentials” in Chapter 1.

•CDE requires that users have permission to write to their home directories. By default, dcecp and the Account Manager set a user’s home directory to “/”. To enable users other than root to write to their home directories, change the default home directory (“/”) to a home directory that the user can write to, such as /users/foo. Failure to take this action could prevent users from accessing the system.

•Principals with a passwd_override entry (for example, root) cannot use the passwd command to change passwords in the passwd_override file. This can be done in two steps. First, use the passwd -r files command to change the password in the /etc/passwd file. Then, as root, cut and paste the appropriate password entry from /etc/passwd into passwd_override.

•By default, the HP DCE 1.7 Security Server disables logins for principals whose passwords have expired, and intervention by cell_admin is required before the principal can log in. If you want to allow a principal to log in with an expired password, attach an instance of the passwd_override ERA to that principal. See the OSF DCE Administration Guide—Core Components and the

6-22

Planning and Configuring HP DCE 1.7