The Results of sec_create_db

Initial Persons, Groups, and Organizations

Principal	Group	Organization
bin	bin	none
daemon	daemon	-
dce-ptgt	kmem	-
dce-rgy	mail	-
krbtgt/local_cell_name	nogroup	-
hosts/local_host/self	none	-
mail	system	-
nobody	tcb	-
root	tty	-
sys	uucp	-
tcb	-	-
uucp	-	-
who	-	-

The accounts that are created by the sec_create_db command are as follows:

· bin bin none

· daemon daemon none

· dce-ptgt none none

· dce-rgy none none

· hosts/local_host/self none none

· krbtgt/cell_name none none

· nobody nogroup none

· root system none

· uucp uucp none

Some of the objects that were initially created by sec_create_db are reserved and cannot be deleted. These are indicated in the following list.

· The reserved principals are as follows:

- dce-ptgt

- krbtgt/cell_name

- dce-rgy

· The reserved group is none.

· The reserved organization is none.

· The reserved accounts are as follows:

- dce-ptgt none none

- krbtgt/cell_name none none

- dce-rgy none none

When you run the sec_create_db command to create the master registry database, you can name the principal who has the most privileged access to the registry. This person is known as the registry creator. If the registry creator you name is not one of the default principals, sec_create_db adds the account rgy_creator none none, where rgy_creator is the principal you named as the registry creator. If you do not name a registry creator, sec_create_db assigns the most privileged registry access to the root system none account.

With one exception, all of the accounts created by the sec_create_db command are assigned randomly generated passwords and are marked as invalid. Before these principals can log into these accounts, you must change the account passwords and mark the accounts as valid. You can do this by using the dcecp account modify command. Creating and Maintaining Accounts provides instructions for using the dcecp account modify command to change all of the attributes for a principal's account in the registry, including the principal's password. Also, dcecp has options to randomly generate new passwords.

However, the exception is that the account created for the registry creator is valid and is assigned the DCE default password (-dce-). Change the default password to ensure the security of the registry creator account.

In addition to the group memberships implied by the accounts that are created by sec_create_db, the principals are also made members of the groups listed in the following table.

Group Memberships Created by sec_create_db

The principal...	Is a member of the group...
who	bin
root	system kmen tty
sys	kmem
mail	mail
tcb	tcb

Creating and Maintaining Principals, Groups, and Organizations provides instructions for adding principals to groups.