HP UX 11i Role-based Access Control (RBAC) Software manual Features

Page 19

Features

HP-UX 11i Security Containment Version B.11.23.02 includes the following components:

Compartments

Compartments isolate unrelated resources on a system, to prevent catastrophic damage to the system if one compartment is penetrated.

When configured in a compartment, an application has restricted access to resources (processes, binaries, data files, and communication channels used) outside its compartment. This restriction is enforced by the HP-UX kernel and cannot be overridden unless specifically configured to do so. If the application is compromised, it will not be able to damage other parts of the system because it is isolated by the compartment configuration.

Fine-Grained Privileges

Traditional UNIX operating systems grant "all or nothing" administrative privileges based on the effective UID of the process that is running. If the process is running with the effective UID=0, it is granted all privileges. With fine-grained privileges, processes are granted only the privileges needed for the task and, optionally, only for the time needed to complete the task. Applications that are privilege-aware can elevate their privilege to the required level for the operation and lower it after the operation completes.

HP-UX Role-Based Access Control (HP-UX RBAC)

Typical UNIX system administration commands must be run by a superuser (root user). Similar to kernel level system call access, access is usually "all or nothing" based on the user's effective UID. HP-UX Role-Based Access Control (HP-UX RBAC) enables you to group common or related tasks into a role. For example, a common role might be User and Group Administration. Once the role is created, users are assigned a role or set of roles that enables them to run the commands defined by those roles.

When you implement HP-UX RBAC, you enable non-root users to perform tasks previously requiring root privileges, without granting those users complete root privileges.

For more information about HP-UX RBAC, refer to the HP-UXRole-Based Access Control B.11.23.04 Release Notes.

HP-UX Standard Mode Security Extensions (SMSE)

In addition to the new Security Containment features, HP-UX 11i v2 has been enhanced to support the following security features, previously available only in trusted mode:

Audit

The HP-UX auditing system records security-related events for analysis. Administrators use auditing to detect and analyze security breaches. Auditing is now available on standard mode HP-UX systems; it was previously available only on trusted mode systems.

User Database

Previously, all Standard Mode HP-UX security attributes and password policy restrictions were set on a systemwide basis. The introduction of the user database enables you to set security attributes on a per-user basis that overrides systemwide defaults.

You can use the user database to enforce the following security measures:

Lock a user account after a specified number of authentication failures

Display the last successful and unsuccessful login

Maintain a password history

Expire inactive user accounts

Prevent users from logging in with a null password

Restrict users to logging in only during specified time periods

Features and Benefits 19

Image 19
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page Publishing History About This DocumentIntended Audience New and Changed Information in This EditionHP-UX Release Name and Release Identifier Typographic ConventionsUserInput HP Encourages Your Comments Related InformationHP-UX 11i Releases Page Account Policy Management AuthorizationHP-UX 11i Security Containment Introduction Conceptual OverviewAuditing Features and BenefitsDefined Terms IsolationFeatures Benefits Installing HP-UX 11i Security Containment InstallationPrerequisites and System Requirements # swlist -a state -l fileset SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swverify SecurityExt# swverify Rbac Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation Installing HP-UX Standard Mode Security Extensions# swlist -a state -l fileset TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swverify TrustedMigration# swremove Rbac Uninstalling HP-UX Standard Mode Security Extensions# swremove TrustedMigration Page HP-UX Rbac Versus Other Rbac Solutions HP-UX Role-Based Access ControlOverview Simplifying Access Control with Roles Access Control BasicsExample of Authorizations Per User HP-UX Rbac Components Example of Authorizations Per RoleHP-UX Rbac Configuration Files HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac ArchitectureHP-UX Rbac Architecture HP-UX Rbac Example Usage and OperationPlanning the HP-UX Rbac Deployment Planning Authorizations for the RolesPlanning the Roles HP-UX Rbac Limitations and Restrictions Planning Command MappingsConfiguring HP-UX Rbac Creating Roles Configuring RolesExample Planning Results Assigning Roles to Users Configuring AuthorizationsAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Examples of Hierarchical Roles Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles OverviewHierarchical Roles Considerations Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Example 3-2 Example of the authadm Command UsageConfiguring HP-UX Rbac with Fine-Grained Privileges Command Configuring HP-UX Rbac with CompartmentsMatches the following /etc/rbac/cmdpriv entries GID Configuring HP-UX Rbac to Generate Audit TrailsProcedure for Auditing HP-UX Rbac Criteria Following is the privrun command syntax Using HP-UX Rbac# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Rbacdbchk Database Syntax Tool Troubleshooting HP-UX RbacPrivrun -v Information Fine-Grained Privileges Components CommandsFine-Grained Privileges Commands Fine-Grained PrivilegesAvailable Privileges Available PrivilegesManpages Fine-Grained Privileges ManpagesOr launch policy Configuring Applications with Fine-Grained PrivilegesCompound Privileges Privilege Model# setfilexsec options filename Privilege Escalation Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Security Implications of Fine-Grained Privileges# getprocxsec options pid Compartment Architecture CompartmentsCompartment Architecture Planning the Compartment Structure Default Compartment Configuration# cmpttune -e Modifying Compartment ConfigurationActivating Compartments # setrules -pChanging Compartment Names Compartment Configuration FilesCompartment Components Changing Compartment RulesCompartment Manpages Compartment CommandsCompartment Configuration Files Compartment CommandsCompartment Definition Compartment Rules and SyntaxFile System Rules Permissionlist IPC RulesIPC mechanism in the current compartment Network RulesAccess Interface Miscellaneous RulesTroubleshooting Compartments Configuring Applications in CompartmentsExample Rules File # vhardlinks Configured rules are loaded into the kernelDo not configure standby LAN interfaces in a compartment Compartments in HP Serviceguard ClustersStandard Mode Security Extensions System Security Attributes Configuring Systemwide AttributesConfiguration Files Security Attributes and the User DatabaseAttributes CommandsManpages Auditing Components Configuring Attributes in the User DatabaseTroubleshooting the User Database AuditingEnabling Auditing Audit CommandsAuditing Your System Planning Your Auditing Implementation#audsys -n -c primaryauditfile -s # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac Monitoring Audit Files#audsys -f Guidelines for Administering Your Auditing SystemAuditing Users Performance Considerations# /usr/sbin/userdbset -u user-nameAUDITFLAG=1 Audevent command optionsAuditing Events Streamlining Audit Log DataSelf-auditing processes Audit Log FilesViewing Audit Logs Configuring Audit Log Files#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Index SymbolsSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb