HP UX 11i Role-based Access Control (RBAC) Software Uninstalling HP-UX 11i Security Containment

Page 24

1.Be sure your system meets all requirements, as described in “Prerequisites and System Requirements”.

2.Download the HP-UX 11i Security Containment bundle from Software Depot, as described in “Installing HP-UX 11i Security Containment”.

3.Log on to your system as the root user.

4.Install HP-UX Standard Mode Security Extensions by using the following command:

#swinstall -x autoreboot=true -s

/tmp/<security_containment_bundle>.depot TrustedMigration PHCO_32144 PHCO_32163 PHCO_32451

5.Go on to “Verifying the HP-UX Standard Mode Security Extensions Installation”.

Verifying the HP-UX Standard Mode Security Extensions Installation

Verify the installation of HP-UX SMSE with the following steps:

1.Run the swverify command to ensure that the bundle installed correctly:

#swverify TrustedMigration

If the installation is successful, many files are displayed and a success message appears after the verification is complete.

2.Run the swlist command to verify that all parts of HP-UX SMSE are configured correctly on your system:

# swlist -a state -l fileset TrustedMigration

If the product is configured correctly, each fileset is displayed as configured.

Uninstalling HP-UX 11i Security Containment

This section describes how to remove the HP-UX 11i Security Containment product from your system.

CAUTION: HP recommends that you leave the SecurityExt bundle on your system. Removing the entire bundle will remove many patches from your system. Instead, remove only the software products as described in the following procedure.

NOTE: You must remove HP-UX 11i Security Containment before you remove HP-UX RBAC or HP-UX SMSE, or you must remove all components at the same time.

To remove HP-UX 11i Security Containment, follow these steps:

1.Log in to your system as the root user.

2.Remove HP-UX 11i Security Containment and all associated software by using the following command:

# swremove -x autoreboot=true TrustedMigration RBAC Containment

3.Use the swlist command to verify that HP-UX 11i Security Containment and all associated components were removed from the system.

The swlist command will not report HP-UX 11i Security Containment if it was successfully removed from the system.

Uninstalling HP-UX RBAC

To remove HP-UX RBAC from your system, follow these steps:

24 Installation

Image 24

Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page About This Document Intended AudienceNew and Changed Information in This Edition Publishing HistoryTypographic Conventions HP-UX Release Name and Release IdentifierUserInput Related Information HP Encourages Your CommentsHP-UX 11i Releases Page Authorization HP-UX 11i Security Containment IntroductionConceptual Overview Account Policy ManagementFeatures and Benefits Defined TermsIsolation AuditingFeatures Benefits Installation Installing HP-UX 11i Security ContainmentPrerequisites and System Requirements Verifying the HP-UX 11i Security Containment Installation # swlist -d @ /tmp/securitycontainmentbundle.depot# swverify SecurityExt # swlist -a state -l fileset SecurityExtInstalling HP-UX Role-Based Access Control Verifying the HP-UX Role-Based Access Control InstallationInstalling HP-UX Standard Mode Security Extensions # swverify RbacUninstalling HP-UX 11i Security Containment Uninstalling HP-UX Rbac# swverify TrustedMigration # swlist -a state -l fileset TrustedMigrationUninstalling HP-UX Standard Mode Security Extensions # swremove Rbac# swremove TrustedMigration Page HP-UX Role-Based Access Control HP-UX Rbac Versus Other Rbac SolutionsOverview Access Control Basics Simplifying Access Control with RolesExample of Authorizations Per User Example of Authorizations Per Role HP-UX Rbac ComponentsHP-UX Rbac Access Control Policy Switch HP-UX Rbac Configuration FilesHP-UX Rbac Commands HP-UX Rbac Configuration FilesHP-UX Rbac Commands HP-UX Rbac ManpagesHP-UX Rbac Architecture HP-UX Rbac ManpagesHP-UX Rbac Example Usage and Operation HP-UX Rbac ArchitecturePlanning Authorizations for the Roles Planning the HP-UX Rbac DeploymentPlanning the Roles Planning Command Mappings HP-UX Rbac Limitations and RestrictionsConfiguring HP-UX Rbac Configuring Roles Creating RolesExample Planning Results Configuring Authorizations Assigning Roles to UsersAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Example Roles Configuration in HP-UX Rbac B.11.23.02 Hierarchical RolesOverview Examples of Hierarchical RolesChanges to the authadm Command for Hierarchical Roles Example 3-1 The authadm Command SyntaxExample 3-2 Example of the authadm Command Usage Hierarchical Roles ConsiderationsConfiguring HP-UX Rbac with Fine-Grained Privileges Configuring HP-UX Rbac with Compartments CommandMatches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac to Generate Audit Trails GIDProcedure for Auditing HP-UX Rbac Criteria Using HP-UX Rbac Following is the privrun command syntax# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Troubleshooting HP-UX Rbac Rbacdbchk Database Syntax ToolPrivrun -v Information Commands Fine-Grained Privileges CommandsFine-Grained Privileges Fine-Grained Privileges ComponentsAvailable Privileges ManpagesFine-Grained Privileges Manpages Available PrivilegesConfiguring Applications with Fine-Grained Privileges Or launch policyPrivilege Model Compound Privileges# setfilexsec options filename Fine-Grained Privileges in HP Serviceguard Clusters Troubleshooting Fine-Grained PrivilegesSecurity Implications of Fine-Grained Privileges Privilege Escalation# getprocxsec options pid Compartments Compartment ArchitectureCompartment Architecture Default Compartment Configuration Planning the Compartment StructureModifying Compartment Configuration Activating Compartments# setrules -p # cmpttune -eCompartment Configuration Files Compartment ComponentsChanging Compartment Rules Changing Compartment NamesCompartment Commands Compartment Configuration FilesCompartment Commands Compartment ManpagesCompartment Rules and Syntax Compartment DefinitionFile System Rules IPC Rules PermissionlistNetwork Rules IPC mechanism in the current compartmentAccess Miscellaneous Rules InterfaceConfiguring Applications in Compartments Troubleshooting CompartmentsExample Rules File Configured rules are loaded into the kernel # vhardlinksCompartments in HP Serviceguard Clusters Do not configure standby LAN interfaces in a compartmentStandard Mode Security Extensions Configuring Systemwide Attributes Configuration FilesSecurity Attributes and the User Database System Security AttributesCommands AttributesManpages Configuring Attributes in the User Database Troubleshooting the User DatabaseAuditing Auditing ComponentsAudit Commands Auditing Your SystemPlanning Your Auditing Implementation Enabling Auditing# audevent -P -F -e admin -e login -e moddac AUDEVENTARGS1 = -P -F -e admin -e login -e moddacMonitoring Audit Files #audsys -n -c primaryauditfile -sGuidelines for Administering Your Auditing System Auditing UsersPerformance Considerations #audsys -fAudevent command options Auditing EventsStreamlining Audit Log Data # /usr/sbin/userdbset -u user-nameAUDITFLAG=1Audit Log Files Self-auditing processesConfiguring Audit Log Files Viewing Audit Logs#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Symbols IndexSecurity attribute defining

Related manuals

Manual 10 pages 36.76 Kb