HP UX 11i Role-based Access Control (RBAC) Software manual About This Document, Intended Audience

Page 13

About This Document

This document describes how to install, configure, and troubleshoot HP-UX 11i Security Containment on HP-UX 11i Version 2.

Intended Audience

This document is intended for system administrators responsible for installing, configuring, and managing HP-UX 11i Security Containment. Administrators are expected to have knowledge of HP-UX 11i v2 operating system concepts, commands, and configuration.

It is helpful to have knowledge of UNIX security concepts, commands, and protocols. Knowledge of HP-UX trusted mode systems is helpful, but not necessary.

This document is not a tutorial.

New and Changed Information in This Edition

HP-UX 11i Security Containment B.11.23.02 offers support for HP-UX Role-Based Access Control B.11.23.04 and HP-UX Standard Mode Security Extensions B.11.23.02.

Publishing History

The document printing date and part number indicate the document's current edition. The printing date will change when a new edition is printed. Table 1 “Publishing History Details” gives a history of printing dates for this document. Minor changes may be made at reprint without changing the printing date. The document part number will change when extensive changes are made.

Document updates may be issued between editions to correct errors or document product changes. To ensure that you receive the updated or new editions, you should subscribe to the appropriate product support service. Consult your HP sales representative for details.

The latest version of this document can be found online at http://www.docs.hp.com.

Table 1 Publishing History Details

Document

Operating Systems

Supported Product Versions

Publication Date

Manufacturing Part

Supported

 

 

Number

 

 

 

5991-8678

HP–UX 11i Version 2

HP-UX 11i Security Containment

March 2007

 

 

version B.11.23.02

 

HP-UX RBAC version B.11.23.01 and higher

HP-UX SMSE version B.11.23.01 and higher

5991-1821HP–UX 11i Version 2 • HP-UX 11i Security Containment May 2005 version B.11.23.01

HP-UX RBAC version B.11.23.01 and higher

HP-UX SMSE version B.11.23.01 and higher

Document Organization

The HP-UX 11i Security Containment Administrator's Guide contains the following information about installing or configuring HP-UX 11i Security Containment:

Intended Audience

13

Image 13
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page Intended Audience About This DocumentNew and Changed Information in This Edition Publishing HistoryHP-UX Release Name and Release Identifier Typographic ConventionsUserInput HP Encourages Your Comments Related InformationHP-UX 11i Releases Page HP-UX 11i Security Containment Introduction AuthorizationConceptual Overview Account Policy ManagementDefined Terms Features and BenefitsIsolation AuditingFeatures Benefits Installing HP-UX 11i Security Containment InstallationPrerequisites and System Requirements # swlist -d @ /tmp/securitycontainmentbundle.depot Verifying the HP-UX 11i Security Containment Installation# swverify SecurityExt # swlist -a state -l fileset SecurityExtVerifying the HP-UX Role-Based Access Control Installation Installing HP-UX Role-Based Access ControlInstalling HP-UX Standard Mode Security Extensions # swverify RbacUninstalling HP-UX Rbac Uninstalling HP-UX 11i Security Containment# swverify TrustedMigration # swlist -a state -l fileset TrustedMigration# swremove Rbac Uninstalling HP-UX Standard Mode Security Extensions# swremove TrustedMigration Page HP-UX Rbac Versus Other Rbac Solutions HP-UX Role-Based Access ControlOverview Simplifying Access Control with Roles Access Control BasicsExample of Authorizations Per User HP-UX Rbac Components Example of Authorizations Per RoleHP-UX Rbac Configuration Files HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Commands HP-UX Rbac Configuration FilesHP-UX Rbac Manpages HP-UX Rbac CommandsHP-UX Rbac Architecture HP-UX Rbac ManpagesHP-UX Rbac Architecture HP-UX Rbac Example Usage and OperationPlanning the HP-UX Rbac Deployment Planning Authorizations for the RolesPlanning the Roles HP-UX Rbac Limitations and Restrictions Planning Command MappingsConfiguring HP-UX Rbac Creating Roles Configuring RolesExample Planning Results Assigning Roles to Users Configuring AuthorizationsAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Hierarchical Roles Example Roles Configuration in HP-UX Rbac B.11.23.02Overview Examples of Hierarchical RolesExample 3-1 The authadm Command Syntax Changes to the authadm Command for Hierarchical RolesExample 3-2 Example of the authadm Command Usage Hierarchical Roles ConsiderationsConfiguring HP-UX Rbac with Fine-Grained Privileges Command Configuring HP-UX Rbac with CompartmentsMatches the following /etc/rbac/cmdpriv entries GID Configuring HP-UX Rbac to Generate Audit TrailsProcedure for Auditing HP-UX Rbac Criteria Following is the privrun command syntax Using HP-UX Rbac# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Rbacdbchk Database Syntax Tool Troubleshooting HP-UX RbacPrivrun -v Information Fine-Grained Privileges Commands CommandsFine-Grained Privileges Fine-Grained Privileges ComponentsManpages Available PrivilegesFine-Grained Privileges Manpages Available PrivilegesOr launch policy Configuring Applications with Fine-Grained PrivilegesCompound Privileges Privilege Model# setfilexsec options filename Troubleshooting Fine-Grained Privileges Fine-Grained Privileges in HP Serviceguard ClustersSecurity Implications of Fine-Grained Privileges Privilege Escalation# getprocxsec options pid Compartment Architecture CompartmentsCompartment Architecture Planning the Compartment Structure Default Compartment ConfigurationActivating Compartments Modifying Compartment Configuration# setrules -p # cmpttune -eCompartment Components Compartment Configuration FilesChanging Compartment Rules Changing Compartment NamesCompartment Configuration Files Compartment CommandsCompartment Commands Compartment ManpagesCompartment Definition Compartment Rules and SyntaxFile System Rules Permissionlist IPC RulesIPC mechanism in the current compartment Network RulesAccess Interface Miscellaneous RulesTroubleshooting Compartments Configuring Applications in CompartmentsExample Rules File # vhardlinks Configured rules are loaded into the kernelDo not configure standby LAN interfaces in a compartment Compartments in HP Serviceguard ClustersStandard Mode Security Extensions Configuration Files Configuring Systemwide AttributesSecurity Attributes and the User Database System Security AttributesAttributes CommandsManpages Troubleshooting the User Database Configuring Attributes in the User DatabaseAuditing Auditing ComponentsAuditing Your System Audit CommandsPlanning Your Auditing Implementation Enabling AuditingAUDEVENTARGS1 = -P -F -e admin -e login -e moddac # audevent -P -F -e admin -e login -e moddacMonitoring Audit Files #audsys -n -c primaryauditfile -sAuditing Users Guidelines for Administering Your Auditing SystemPerformance Considerations #audsys -fAuditing Events Audevent command optionsStreamlining Audit Log Data # /usr/sbin/userdbset -u user-nameAUDITFLAG=1Self-auditing processes Audit Log FilesViewing Audit Logs Configuring Audit Log Files#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Index SymbolsSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb