G06.30 Software Installation and Upgrade Guide

Overview of Installing G06.30
G06.30 Software Installation and Upgrade Guide—543764-002
1-44
Password Enhancements and OSS ACL Support
For more details, see Section 10 of the Safeguard Administrator's Manual.
Fallback Considerations for Password Encryption
Because of the new password encryption algorithm, fallback requires advance
planning.
In all cases, fall back to the previous version of security software.
If PASSWORD-ENCRYPT is OFF or PASSWORD-ALGORITHM is set to DES, no
extra fallback steps are required.
If PASSWORD-ENCRYPT is HMAC256, extra fallback steps are required. When users
first change their password after HMAC256 is enabled, they must remember their
immediate previous password. This is especially important for the system
administrator. After installing the previous version of Safeguard and Standard Security:
1. Before starting Safeguard, the system administrator must log in with the old
password. The old password is the one used before the algorithm was changed to
HMAC256.
2. Start Safeguard.
3. The system administrator must set a grace period for users to change their expired
passwords.
4. Users are prompted to change their password when logging into the system if:
•
Their user account existed before the installation of the G03 version of
Safeguard.
or
•
They are new users and their password was encrypted in DES or not
encrypted at all before PASSWORD-ALGORITHM was changed to HMAC256.
When prompted, users should enter and reenter a new password and log into the
system as usual.
5. If new users were added to the system after PASSWORD-ALGORITHM was
changed to HMAC256, the system administrator must reset their passwords to
enable them to log into the system. Otherwise, the users cannot access the system
after fallback.
Fallback Considerations for OSS ACL
•
After fallback, the AUDIT-CLIENT-GUARDIAN attribute, which is a synonym for
AUDIT-CLIENT-SERVICE, will no longer be applicable.
Note. The Safeguard configuration attribute AUDIT-CLIENT-OSS is set to ON by default. If you
do not want to audit client subsystems other than OSS, you can disable the AUDIT-CLIENT-
GUARDIAN attribute after migration. To roll the audit file, use the SAFECOM NEXTFILE
command.