HP UX 11i Role-based Access Control (RBAC) Software manual Benefits

Page 20

Benefits

Using HP-UX 11i Security Containment to secure your system offers the following benefits:

Integrated security

You can use HP-UX Standard Mode Security Extensions in combination with the new security containment features to enhance the security of your HP-UX systems.

Fewer users who need full superuser access to systems

Using HP-UX RBAC, you can give users specific administrator-level privileges on a system without giving those users full superuser access. These users can perform only specific administrative tasks on the system, as defined by their roles. This provides strong internal system security.

Isolation of system resources

Using compartments, you can isolate applications and resources on a single system. Even if the security of one application is compromised, other resources on the system remain secure.

Interoperable with existing HP-UX 11i security products

You can integrate HP-UX 11i Security Containment with your existing HP-UX security solution. HP-UX 11i Security Containment works with all other HP-UX 11i v2 security products and features.

No need to modify existing applications

HP-UX 11i Security Containment can be configured to be transparent at the application layer. You do not need to modify your existing applications to use HP-UX 11i Security Containment.

Interoperability with HP Serviceguard

HP Serviceguard is comparable with the HP-UX 11i Security Containment default configuration. Because Serviceguard requires communication and control between many processes and nodes, be sure to follow all constraints described in this document if you change the default containment configuration.

For more information about configuring HP-UX 11i Security Containment to ensure proper cluster operation for appropriate enforcement of security policies, refer to “Fine-Grained Privileges in HP Serviceguard Clusters” and “Compartments in HP Serviceguard Clusters”.

20 HP-UX 11i Security Containment Introduction

Image 20
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page About This Document Intended AudienceNew and Changed Information in This Edition Publishing HistoryUserInput Typographic ConventionsHP-UX Release Name and Release Identifier HP-UX 11i Releases Related InformationHP Encourages Your Comments Page Authorization HP-UX 11i Security Containment IntroductionConceptual Overview Account Policy ManagementFeatures and Benefits Defined TermsIsolation AuditingFeatures Benefits Prerequisites and System Requirements InstallationInstalling HP-UX 11i Security Containment Verifying the HP-UX 11i Security Containment Installation # swlist -d @ /tmp/securitycontainmentbundle.depot# swverify SecurityExt # swlist -a state -l fileset SecurityExtInstalling HP-UX Role-Based Access Control Verifying the HP-UX Role-Based Access Control InstallationInstalling HP-UX Standard Mode Security Extensions # swverify RbacUninstalling HP-UX 11i Security Containment Uninstalling HP-UX Rbac# swverify TrustedMigration # swlist -a state -l fileset TrustedMigration# swremove TrustedMigration Uninstalling HP-UX Standard Mode Security Extensions# swremove Rbac Page Overview HP-UX Role-Based Access ControlHP-UX Rbac Versus Other Rbac Solutions Example of Authorizations Per User Access Control BasicsSimplifying Access Control with Roles Example of Authorizations Per Role HP-UX Rbac ComponentsHP-UX Rbac Access Control Policy Switch HP-UX Rbac Configuration FilesHP-UX Rbac Commands HP-UX Rbac Configuration FilesHP-UX Rbac Commands HP-UX Rbac ManpagesHP-UX Rbac Architecture HP-UX Rbac ManpagesHP-UX Rbac Example Usage and Operation HP-UX Rbac ArchitecturePlanning the Roles Planning Authorizations for the RolesPlanning the HP-UX Rbac Deployment Planning Command Mappings HP-UX Rbac Limitations and RestrictionsConfiguring HP-UX Rbac Example Planning Results Configuring RolesCreating Roles Assigning Roles to Groups Configuring AuthorizationsAssigning Roles to Users Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Example Roles Configuration in HP-UX Rbac B.11.23.02 Hierarchical RolesOverview Examples of Hierarchical RolesChanges to the authadm Command for Hierarchical Roles Example 3-1 The authadm Command SyntaxExample 3-2 Example of the authadm Command Usage Hierarchical Roles ConsiderationsConfiguring HP-UX Rbac with Fine-Grained Privileges Matches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac with CompartmentsCommand Configuring HP-UX Rbac to Generate Audit Trails GIDProcedure for Auditing HP-UX Rbac Criteria Using HP-UX Rbac Following is the privrun command syntax# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Privrun -v Information Troubleshooting HP-UX RbacRbacdbchk Database Syntax Tool Commands Fine-Grained Privileges CommandsFine-Grained Privileges Fine-Grained Privileges ComponentsAvailable Privileges ManpagesFine-Grained Privileges Manpages Available PrivilegesConfiguring Applications with Fine-Grained Privileges Or launch policy# setfilexsec options filename Privilege ModelCompound Privileges Fine-Grained Privileges in HP Serviceguard Clusters Troubleshooting Fine-Grained PrivilegesSecurity Implications of Fine-Grained Privileges Privilege Escalation# getprocxsec options pid Compartments Compartment ArchitectureCompartment Architecture Default Compartment Configuration Planning the Compartment StructureModifying Compartment Configuration Activating Compartments# setrules -p # cmpttune -eCompartment Configuration Files Compartment ComponentsChanging Compartment Rules Changing Compartment NamesCompartment Commands Compartment Configuration FilesCompartment Commands Compartment ManpagesFile System Rules Compartment Rules and SyntaxCompartment Definition IPC Rules PermissionlistNetwork Rules IPC mechanism in the current compartmentAccess Miscellaneous Rules InterfaceExample Rules File Configuring Applications in CompartmentsTroubleshooting Compartments Configured rules are loaded into the kernel # vhardlinksCompartments in HP Serviceguard Clusters Do not configure standby LAN interfaces in a compartmentStandard Mode Security Extensions Configuring Systemwide Attributes Configuration FilesSecurity Attributes and the User Database System Security AttributesManpages CommandsAttributes Configuring Attributes in the User Database Troubleshooting the User DatabaseAuditing Auditing ComponentsAudit Commands Auditing Your SystemPlanning Your Auditing Implementation Enabling Auditing# audevent -P -F -e admin -e login -e moddac AUDEVENTARGS1 = -P -F -e admin -e login -e moddacMonitoring Audit Files #audsys -n -c primaryauditfile -sGuidelines for Administering Your Auditing System Auditing UsersPerformance Considerations #audsys -fAudevent command options Auditing EventsStreamlining Audit Log Data # /usr/sbin/userdbset -u user-nameAUDITFLAG=1Audit Log Files Self-auditing processes#/usr/sbin/audisp auditfile Configuring Audit Log FilesViewing Audit Logs Examples of Using the audisp Command Page Symbols IndexSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb