HP UX Security Products and Features Software manual Flac policies, Creating a Flac policy

Page 54

<pubkey> Public key being authorized

For example, user adm uses administrator key /home/adm/adm.pvt to authorize /home/usr1/ usr.pub as a WLI user key:

%wlicert -i usr1.key1 -k /home/adm/adm.pvt /home/usr1/usr.pub

C.3 FLAC policies

A FLAC policy prevents a regular file or directory from being modified, deleted, or renamed. It also prevents change of ownership and permission bits, modification time, and other persistent information associated with the file. These restrictions apply to all users including root user. A file is locked when it has a FLAC policy actively being enforced by WLI. A user must own a file to assign it a FLAC policy.

C.3.1 Creating a FLAC policy

In this example, the file /tmp/passwd is locked. The administrator private key is /home/adm/ adm.pvt. The user private key file is /home/usr1/usr.pvt. The user public key file is /home/ usr1/usr.pub. To generate the FLAC policy:

%wlipolicy -f -a -k /home/usr1/usr.pvt /tmp/passwd

A prompt appears for the passphrase for /home/usr1/usr.pvt.

C.3.2 Enabling a FLAC policy

If /home/usr1/usr.pvt is authorized as a WLI user key, as in the example in Section C.2.2 (page 53), no further action is necessary. The key can be authorized after policy generation with the identical command:

%wlicert -i usr1.key1 -k /home/adm/adm.pvt /home/usr1/usr.pub

A prompt appears for the passphrase for /home/adm/adm.pvt.

C.3.3 Testing a FLAC policy

For example, the FLAC created and enabled in the previous example is tested. Verify that system-wide policy enforcement is in effect:

%wlisyspolicy -g

The returned messages must include:

“Values in effect currently:”

 

write lock

protection (FLAC):

enabled

protection

mode:

restricted

If either or both of the above settings are not in effect, system-wide FLAC policy enforcement can be enabled with:

%wlisyspolicy -s mode=restricted,flac=enabled -k /home/adm/adm.pvt

Any user, including root, cannot modify, rename, or delete /tmp/passwd:

%mv /tmp/passwd /tmp/x

mv: /tmp/x: rename: Permission denied

%rm /tmp/passwd

/tmp/passwd: 666 mode ? (y/n) y

rm: /tmp/passwd not removed. Permission denied

%echo hello >> /tmp/passwd

ksh: /tmp/passwd: cannot create

Any user with read permission on the file can still read its content:

%cat /tmp/passwd

hi there

54 Quick setup examples

Image 54
Contents HP-UX Whitelisting A.01.00 Administrator Guide Copyright 2010 Hewlett-Packard Development Company, L.P Table of Contents HP Serviceguard considerations Glossary Index List of Figures List of Examples Page Security features File access policiesFile lock access controls Identity-based access controls Capabilities4 api Page Product overview WLI architectureCommands Application APIApplications WLI database WLI metadata files3 .$WLISIGNATURE$ Page Key usage Generating keysAdministrator keys User keysInstalling, removing, and upgrading Installation requirementsInstalling WLI Removing WLI Upgrading WLI Page Configuring Authorizing the recovery keyAuthorizing administrator keys Signing DLKMs Backing up the WLI databaseRebooting to restricted mode Page Enhancing security with WLI Signing an executable binaryCreating a Flac policy Removing a file access policy Enabling DLKMs to load during bootCreating an Ibac policy Loading unsigned DLKMs # wlisign -a -k /home/admin1/adminpriv /usr/conf/mod/cissWlisign -a -k adminpriv /usr/sbin/kcmodule # kcmodule ciss=unusedPage Backup and restore considerations OverviewWLI database files Read/write protected files Policy protected and metadata filesWrite protected RecommendationsFlac policies Ibac policiesMetadata files Page HP Serviceguard considerations AdministrationWLI database Policy protected files WLI reinstallation Troubleshooting and known issuesSoftware distributor issues Lost WLI administrator key or passphrase# tar -xf /tmp/wlikeydb.tar Wlisyspolicy -s mode=maintenance -k adminkeySu root # rm -r /etc/wli # kcmodule wli=unused # shutdown -rSupport and other resources Contacting HPRelated information Typographic conventions WebsitesUser input Times Page # make all # make cleanInstructions # su wliusr1Flac add and delete program Ibac add and delete programIbac add and delete program Page Administration examples Wlicert -s -c wli.admin1 -o wmd -k adm1.pvt Su root # wlisign -a -k adm1.pvt /usr/bin/tarCat /tmp/.$WLIFSPARMS$ Tar -vtf tartest.tarBdf mydir Wlisys -k adm1.pvt -s wmdstoretype=pseudoBpbackup -f backuplist Bprestore -f backuplistAuthorizing an administrator key Quick setup examplesConfiguring WLI Authorizing a user keyCreating a Flac policy Testing a Flac policyFlac policies Enabling a Flac policyIbac policies Disabling an Ibac policy Removing an Ibac policyGlossary ASMPage Symbols IndexIndex
Related manuals
Manual 130 pages 58.55 Kb