HP UX 11i Role-based Access Control (RBAC) Software Installing HP-UX Role-Based Access Control

Page 23

Installing HP-UX Role-Based Access Control

The following procedure describes how to install only HP-UX RBAC from the HP-UX 11i Security Containment bundle. To download and install HP-UX RBAC as a separate product, refer to the HP-UX RBAC Version B.11.23.04 Release Notes on http://docs.hp.com. To download and install the full HP-UX 11i Security Containment feature set, refer to “Installing HP-UX 11i Security Containment”.

NOTE: If you have installed the full HP-UX 11i Security Containment feature set, you already have HP-UX RBAC installed.

To install HP-UX RBAC, follow these steps:

1.Be sure your system meets all requirements, as described in “Prerequisites and System Requirements”.

2.Download the HP-UX 11i Security Containment bundle from Software Depot, as described in “Installing HP-UX 11i Security Containment”.

3.Log in to your system as the root user.

4.Install HP-UX RBAC by using the following command:

# swinstall -x autoreboot=true -s /tmp/<security_containment_bundle>.depot RBAC

5.Go on to “Verifying the HP-UXRole-Based Access Control Installation”.

NOTE: If you install HP-UX RBAC version B.11.23.02 on a system with version B.11.23.01 already installed, and you have modified the database files, the new version does not overwrite the database files.

Verifying the HP-UX Role-Based Access Control Installation

Verify the installation of HP-UX RBAC with the following steps:

1.Run the swverify command to ensure that the bundle installed correctly:

#swverify RBAC

If the installation is successful, many files are displayed and a success message appears after the verification is complete.

2.Run the swlist command to verify that all parts of HP-UX RBAC are configured correctly on your system:

#swlist -a state -l fileset RBAC

If the product is configured correctly, each fileset is displayed as configured.

Installing HP-UX Standard Mode Security Extensions

The following procedure describes how to install only HP-UX Standard Mode Security Extensions (SMSE) from the HP-UX 11i Security Containment bundle. To download and install HP-UX SMSE as a separate product, refer to the HP-UX Standard Mode Security Extensions B.11.23.02 Release Notes (part number 5991–8711) on http://docs.hp.com. To install the full HP-UX 11i Security Containment feature set, refer to “Installing HP-UX 11i Security Containment”.

NOTE: If you have installed the full HP-UX 11i Security Containment feature set, you already have HP-UX SMSE installed.

To install HP-UX Standard Mode Security Extensions, follow these steps:

Installing HP-UX Role-Based Access Control 23

Image 23
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page Publishing History About This DocumentIntended Audience New and Changed Information in This EditionUserInput Typographic ConventionsHP-UX Release Name and Release Identifier HP-UX 11i Releases Related InformationHP Encourages Your Comments Page Account Policy Management AuthorizationHP-UX 11i Security Containment Introduction Conceptual OverviewAuditing Features and BenefitsDefined Terms IsolationFeatures Benefits Prerequisites and System Requirements InstallationInstalling HP-UX 11i Security Containment # swlist -a state -l fileset SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swverify SecurityExt# swverify Rbac Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation Installing HP-UX Standard Mode Security Extensions# swlist -a state -l fileset TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swverify TrustedMigration# swremove TrustedMigration Uninstalling HP-UX Standard Mode Security Extensions# swremove Rbac Page Overview HP-UX Role-Based Access ControlHP-UX Rbac Versus Other Rbac Solutions Example of Authorizations Per User Access Control BasicsSimplifying Access Control with Roles HP-UX Rbac Components Example of Authorizations Per RoleHP-UX Rbac Configuration Files HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac ArchitectureHP-UX Rbac Architecture HP-UX Rbac Example Usage and OperationPlanning the Roles Planning Authorizations for the RolesPlanning the HP-UX Rbac Deployment HP-UX Rbac Limitations and Restrictions Planning Command MappingsConfiguring HP-UX Rbac Example Planning Results Configuring RolesCreating Roles Assigning Roles to Groups Configuring AuthorizationsAssigning Roles to Users Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Examples of Hierarchical Roles Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles OverviewHierarchical Roles Considerations Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Example 3-2 Example of the authadm Command UsageConfiguring HP-UX Rbac with Fine-Grained Privileges Matches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac with CompartmentsCommand GID Configuring HP-UX Rbac to Generate Audit TrailsProcedure for Auditing HP-UX Rbac Criteria Following is the privrun command syntax Using HP-UX Rbac# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Privrun -v Information Troubleshooting HP-UX RbacRbacdbchk Database Syntax Tool Fine-Grained Privileges Components CommandsFine-Grained Privileges Commands Fine-Grained PrivilegesAvailable Privileges Available PrivilegesManpages Fine-Grained Privileges ManpagesOr launch policy Configuring Applications with Fine-Grained Privileges# setfilexsec options filename Privilege ModelCompound Privileges Privilege Escalation Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Security Implications of Fine-Grained Privileges# getprocxsec options pid Compartment Architecture CompartmentsCompartment Architecture Planning the Compartment Structure Default Compartment Configuration# cmpttune -e Modifying Compartment ConfigurationActivating Compartments # setrules -pChanging Compartment Names Compartment Configuration FilesCompartment Components Changing Compartment RulesCompartment Manpages Compartment CommandsCompartment Configuration Files Compartment CommandsFile System Rules Compartment Rules and SyntaxCompartment Definition Permissionlist IPC RulesIPC mechanism in the current compartment Network RulesAccess Interface Miscellaneous RulesExample Rules File Configuring Applications in CompartmentsTroubleshooting Compartments # vhardlinks Configured rules are loaded into the kernelDo not configure standby LAN interfaces in a compartment Compartments in HP Serviceguard ClustersStandard Mode Security Extensions System Security Attributes Configuring Systemwide AttributesConfiguration Files Security Attributes and the User DatabaseManpages CommandsAttributes Auditing Components Configuring Attributes in the User DatabaseTroubleshooting the User Database AuditingEnabling Auditing Audit CommandsAuditing Your System Planning Your Auditing Implementation#audsys -n -c primaryauditfile -s # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac Monitoring Audit Files#audsys -f Guidelines for Administering Your Auditing SystemAuditing Users Performance Considerations# /usr/sbin/userdbset -u user-nameAUDITFLAG=1 Audevent command optionsAuditing Events Streamlining Audit Log DataSelf-auditing processes Audit Log Files#/usr/sbin/audisp auditfile Configuring Audit Log FilesViewing Audit Logs Examples of Using the audisp Command Page Index SymbolsSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb