HP UX 11i Role-based Access Control (RBAC) Software manual # swverify SecurityExt

Page 22

IMPORTANT: The HP-UX 11i Security Containment feature includes HP-UX RBAC as one of its components. If you install the HP-UX 11i Security Containment feature on a system that has HP-UX RBAC on it as an independent software unit, you must reconfigure HP-UX RBAC before you can use it with the fine-grained privileges and compartments components of HP-UX 11i Security Containment. Use the following command to reconfigure HP-UX RBAC:

#swconfig -x autoselect_dependencies=false -x reconfigure=true RBAC

To download the HP-UX 11i Security Containment bundle from Software Depot, follow these steps:

1.Go to HP Software Depot at http://www.hp.com/go/softwaredepot.

2.Search for HP-UX 11i Security Containment. Read the product information Web page for the latest updates and release information.

3.Click Receive for Free>>.

4.Choose the correct version of HP-UX 11i Security Containment for your system.

5.Enter your registration information. Read and accept the Terms and Conditions and the Software License Agreement.

6.Click Download. Save the HP-UX 11i Security Containment bundle, SecurityExt, as a local file on your system. For example:

/tmp/<security_containment_bundle>.depot

NOTE: The name of the HP-UX 11i Security Containment bundle may change. Check Software Depot for the correct bundle name.

7.Verify that the depot file is saved on your system by using the following command:

# swlist -d @ /tmp/<security_containment_bundle>.depot

To install HP-UX 11i Security Containment, follow these steps:

1.Be sure your system meets all requirements, as described in “Prerequisites and System Requirements”.

2.Download the HP-UX 11i Security Containment bundle from Software Depot as described in the previous procedure.

3.Log in to your system as the root user.

4.Install HP-UX 11i Security Containment by using the following command:

#swinstall -x autoreboot=true -s

/tmp/<security_containment_bundle>.depot SecurityExt

5.Go on to “Verifying the HP-UX 11i Security Containment Installation”.

Verifying the HP-UX 11i Security Containment Installation

Verify the installation of HP-UX 11i Security Containment with the following steps:

1.Run the swverify command to ensure that the bundle installed correctly:

#swverify SecurityExt

If the installation is successful, many files are displayed and a success message appears after the verification is complete.

2.Run the swlist command to verify that all parts of HP-UX 11i Security Containment are configured correctly on your system:

# swlist -a state -l fileset SecurityExt

If the product is configured correctly, each fileset is displayed as configured.

22 Installation

Page 21 Page 23
Image 22
Page 21 Page 23
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page New and Changed Information in This Edition About This DocumentIntended Audience Publishing HistoryHP-UX Release Name and Release Identifier Typographic ConventionsUserInput HP Encourages Your Comments Related InformationHP-UX 11i Releases Page Conceptual Overview AuthorizationHP-UX 11i Security Containment Introduction Account Policy ManagementIsolation Features and BenefitsDefined Terms AuditingFeatures Benefits Installing HP-UX 11i Security Containment InstallationPrerequisites and System Requirements # swverify SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swlist -a state -l fileset SecurityExtInstalling HP-UX Standard Mode Security Extensions Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation # swverify Rbac# swverify TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swlist -a state -l fileset TrustedMigration# swremove Rbac Uninstalling HP-UX Standard Mode Security Extensions# swremove TrustedMigration Page HP-UX Rbac Versus Other Rbac Solutions HP-UX Role-Based Access ControlOverview Simplifying Access Control with Roles Access Control BasicsExample of Authorizations Per User Example of Authorizations Per Role HP-UX Rbac ComponentsHP-UX Rbac Commands HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac Configuration FilesHP-UX Rbac Architecture HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac ManpagesHP-UX Rbac Example Usage and Operation HP-UX Rbac ArchitecturePlanning the HP-UX Rbac Deployment Planning Authorizations for the RolesPlanning the Roles Planning Command Mappings HP-UX Rbac Limitations and RestrictionsConfiguring HP-UX Rbac Creating Roles Configuring RolesExample Planning Results Assigning Roles to Users Configuring AuthorizationsAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Overview Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles Examples of Hierarchical RolesExample 3-2 Example of the authadm Command Usage Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Hierarchical Roles ConsiderationsConfiguring HP-UX Rbac with Fine-Grained Privileges Command Configuring HP-UX Rbac with CompartmentsMatches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac to Generate Audit Trails GIDProcedure for Auditing HP-UX Rbac Criteria Using HP-UX Rbac Following is the privrun command syntax# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Rbacdbchk Database Syntax Tool Troubleshooting HP-UX RbacPrivrun -v Information Fine-Grained Privileges CommandsFine-Grained Privileges Commands Fine-Grained Privileges ComponentsFine-Grained Privileges Manpages Available PrivilegesManpages Available PrivilegesConfiguring Applications with Fine-Grained Privileges Or launch policyCompound Privileges Privilege Model# setfilexsec options filename Security Implications of Fine-Grained Privileges Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Privilege Escalation# getprocxsec options pid Compartments Compartment ArchitectureCompartment Architecture Default Compartment Configuration Planning the Compartment Structure# setrules -p Modifying Compartment ConfigurationActivating Compartments # cmpttune -eChanging Compartment Rules Compartment Configuration FilesCompartment Components Changing Compartment NamesCompartment Commands Compartment CommandsCompartment Configuration Files Compartment ManpagesCompartment Definition Compartment Rules and SyntaxFile System Rules IPC Rules PermissionlistNetwork Rules IPC mechanism in the current compartmentAccess Miscellaneous Rules InterfaceTroubleshooting Compartments Configuring Applications in CompartmentsExample Rules File Configured rules are loaded into the kernel # vhardlinksCompartments in HP Serviceguard Clusters Do not configure standby LAN interfaces in a compartmentStandard Mode Security Extensions Security Attributes and the User Database Configuring Systemwide AttributesConfiguration Files System Security AttributesAttributes CommandsManpages Auditing Configuring Attributes in the User DatabaseTroubleshooting the User Database Auditing ComponentsPlanning Your Auditing Implementation Audit CommandsAuditing Your System Enabling AuditingMonitoring Audit Files # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac #audsys -n -c primaryauditfile -sPerformance Considerations Guidelines for Administering Your Auditing SystemAuditing Users #audsys -fStreamlining Audit Log Data Audevent command optionsAuditing Events # /usr/sbin/userdbset -u user-nameAUDITFLAG=1Audit Log Files Self-auditing processesViewing Audit Logs Configuring Audit Log Files#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Symbols IndexSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb
Top Page Image Contents