HP UX 11i Role-based Access Control (RBAC) Software manual Typographic Conventions, UserInput

Page 14

Chapter 1 "Chapter 1 “HP-UX 11i Security Containment Introduction”." Use this chapter to learn about the security containment features and how those features work together to secure your HP-UX 11i v2 system.

Chapter 2 "Chapter 2 “Installation”." Use this chapter to plan and execute the installation of the full HP-UX 11i Security Containment product or individual security containment components.

Chapter 3 "Chapter 3 “HP-UXRole-Based Access Control”." Use this chapter to learn how to configure and administer HP-UX RBAC.

Chapter 4 "Chapter 4 “Fine-Grained Privileges”." Use this chapter to learn how to administer fine-grained privileges.

Chapter 5 "Chapter 5 “Compartments”." Use this chapter to learn how to configure and administer compartments.

Chapter 6 "Chapter 6 “Standard Mode Security Extensions”." Use this chapter to learn how to configure and administer the user database, per-user security attributes, and system auditing.

Typographic Conventions

This document uses the following conventions:

audit(5)

An HP-UX manpage. In this example, audit is the name and 5 is the section in

 

the HP-UX Reference. On the Web and on the Instant Information CD, it may

 

be a hot link to the manpage itself. From the HP-UX command line, you can

 

enter “man audit” or “man 5 audit” to view the manpage. Refer to man(1).

Book Title

The title of a book. On the Web and on the Instant Information CD, it may be

 

a hot link to the book itself.

KeyCap

The name of a keyboard key. Return and Enter both refer to the same key.

Emphasis

Text that is emphasized.

Bold

Text that is strongly emphasized.

Bold

The defined use of an important word or phrase.

ComputerOut

Text displayed by the computer.

UserInput

Commands and other text that you type.

Command

A command name or qualified command phrase.

Variable

The name of a variable that you may replace in a command or function or

 

information in a display that represents several possible values.

[ ]

The contents are optional in formats and command descriptions. If the contents

 

are a list separated by , you must choose one of the items.

{ }

The contents are required in formats and command descriptions. If the contents

 

are a list separated by , you must choose one of the items.

...

The preceding element may be repeated an arbitrary number of times.

Separates items in a list of choices.

HP-UX Release Name and Release Identifier

Each HP-UX 11i release has an associated release name and release identifier. Theuname(1) command with the -roption returns the release identifier. Table 2 “HP-UX 11i Releases” lists the releases available for HP-UX 11i.

14 About This Document

Image 14
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page New and Changed Information in This Edition About This DocumentIntended Audience Publishing HistoryUserInput Typographic ConventionsHP-UX Release Name and Release Identifier HP-UX 11i Releases Related InformationHP Encourages Your Comments Page Conceptual Overview AuthorizationHP-UX 11i Security Containment Introduction Account Policy ManagementIsolation Features and BenefitsDefined Terms AuditingFeatures Benefits Prerequisites and System Requirements InstallationInstalling HP-UX 11i Security Containment # swverify SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swlist -a state -l fileset SecurityExtInstalling HP-UX Standard Mode Security Extensions Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation # swverify Rbac# swverify TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swlist -a state -l fileset TrustedMigration# swremove TrustedMigration Uninstalling HP-UX Standard Mode Security Extensions# swremove Rbac Page Overview HP-UX Role-Based Access ControlHP-UX Rbac Versus Other Rbac Solutions Example of Authorizations Per User Access Control BasicsSimplifying Access Control with Roles Example of Authorizations Per Role HP-UX Rbac ComponentsHP-UX Rbac Commands HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac Configuration FilesHP-UX Rbac Architecture HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac ManpagesHP-UX Rbac Example Usage and Operation HP-UX Rbac ArchitecturePlanning the Roles Planning Authorizations for the RolesPlanning the HP-UX Rbac Deployment Planning Command Mappings HP-UX Rbac Limitations and RestrictionsConfiguring HP-UX Rbac Example Planning Results Configuring RolesCreating Roles Assigning Roles to Groups Configuring AuthorizationsAssigning Roles to Users Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Overview Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles Examples of Hierarchical RolesExample 3-2 Example of the authadm Command Usage Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Hierarchical Roles ConsiderationsConfiguring HP-UX Rbac with Fine-Grained Privileges Matches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac with CompartmentsCommand Configuring HP-UX Rbac to Generate Audit Trails GIDProcedure for Auditing HP-UX Rbac Criteria Using HP-UX Rbac Following is the privrun command syntax# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Privrun -v Information Troubleshooting HP-UX RbacRbacdbchk Database Syntax Tool Fine-Grained Privileges CommandsFine-Grained Privileges Commands Fine-Grained Privileges ComponentsFine-Grained Privileges Manpages Available PrivilegesManpages Available PrivilegesConfiguring Applications with Fine-Grained Privileges Or launch policy# setfilexsec options filename Privilege ModelCompound Privileges Security Implications of Fine-Grained Privileges Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Privilege Escalation# getprocxsec options pid Compartments Compartment ArchitectureCompartment Architecture Default Compartment Configuration Planning the Compartment Structure# setrules -p Modifying Compartment ConfigurationActivating Compartments # cmpttune -eChanging Compartment Rules Compartment Configuration FilesCompartment Components Changing Compartment NamesCompartment Commands Compartment CommandsCompartment Configuration Files Compartment ManpagesFile System Rules Compartment Rules and SyntaxCompartment Definition IPC Rules PermissionlistNetwork Rules IPC mechanism in the current compartmentAccess Miscellaneous Rules InterfaceExample Rules File Configuring Applications in CompartmentsTroubleshooting Compartments Configured rules are loaded into the kernel # vhardlinksCompartments in HP Serviceguard Clusters Do not configure standby LAN interfaces in a compartmentStandard Mode Security Extensions Security Attributes and the User Database Configuring Systemwide AttributesConfiguration Files System Security AttributesManpages CommandsAttributes Auditing Configuring Attributes in the User DatabaseTroubleshooting the User Database Auditing ComponentsPlanning Your Auditing Implementation Audit CommandsAuditing Your System Enabling AuditingMonitoring Audit Files # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac #audsys -n -c primaryauditfile -sPerformance Considerations Guidelines for Administering Your Auditing SystemAuditing Users #audsys -fStreamlining Audit Log Data Audevent command optionsAuditing Events # /usr/sbin/userdbset -u user-nameAUDITFLAG=1Audit Log Files Self-auditing processes#/usr/sbin/audisp auditfile Configuring Audit Log FilesViewing Audit Logs Examples of Using the audisp Command Page Symbols IndexSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb