HP UX 11i Role-based Access Control (RBAC) Software manual Index

Page 5

Activating Compartments

60

Modifying Compartment Configuration

60

Changing Compartment Rules

61

Changing Compartment Names

61

Compartment Components

61

Compartment Configuration Files

61

Compartment Commands

62

Compartment Manpages

62

Compartment Rules and Syntax

63

Compartment Definition

63

File System Rules

63

IPC Rules

64

Network Rules

65

Miscellaneous Rules

67

Example Rules File

68

Configuring Applications in Compartments

68

Troubleshooting Compartments

68

Compartments in HP Serviceguard Clusters

70

6 Standard Mode Security Extensions

71

Overview

71

Security Attributes and the User Database

72

System Security Attributes

72

Configuring Systemwide Attributes

72

User Database Components

72

Configuration Files

72

Commands

73

Attributes

73

Manpages

73

Configuring Attributes in the User Database

74

Troubleshooting the User Database

74

Auditing

74

Auditing Components

74

Commands

75

Manpages

75

Auditing Your System

75

Step 1: Planning Your Auditing Implementation

75

Step 2: Enabling Auditing

75

Step 3: Monitoring Audit Files

76

Performance Considerations

77

Guidelines for Administering Your Auditing System

77

Auditing Users

77

Auditing Events

78

Streamlining Audit Log Data

78

Audit Log Files

79

Configuring Audit Log Files

80

Viewing Audit Logs

80

Examples of Using the audisp Command

81

Index

83

Table of Contents

5

Image 5
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page Intended Audience About This DocumentNew and Changed Information in This Edition Publishing HistoryUserInput Typographic ConventionsHP-UX Release Name and Release Identifier HP-UX 11i Releases Related InformationHP Encourages Your Comments Page HP-UX 11i Security Containment Introduction AuthorizationConceptual Overview Account Policy ManagementDefined Terms Features and BenefitsIsolation AuditingFeatures Benefits Prerequisites and System Requirements InstallationInstalling HP-UX 11i Security Containment # swlist -d @ /tmp/securitycontainmentbundle.depot Verifying the HP-UX 11i Security Containment Installation# swverify SecurityExt # swlist -a state -l fileset SecurityExtVerifying the HP-UX Role-Based Access Control Installation Installing HP-UX Role-Based Access ControlInstalling HP-UX Standard Mode Security Extensions # swverify RbacUninstalling HP-UX Rbac Uninstalling HP-UX 11i Security Containment# swverify TrustedMigration # swlist -a state -l fileset TrustedMigration# swremove TrustedMigration Uninstalling HP-UX Standard Mode Security Extensions# swremove Rbac Page Overview HP-UX Role-Based Access ControlHP-UX Rbac Versus Other Rbac Solutions Example of Authorizations Per User Access Control BasicsSimplifying Access Control with Roles HP-UX Rbac Components Example of Authorizations Per RoleHP-UX Rbac Configuration Files HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Commands HP-UX Rbac Configuration FilesHP-UX Rbac Manpages HP-UX Rbac CommandsHP-UX Rbac Architecture HP-UX Rbac ManpagesHP-UX Rbac Architecture HP-UX Rbac Example Usage and OperationPlanning the Roles Planning Authorizations for the RolesPlanning the HP-UX Rbac Deployment HP-UX Rbac Limitations and Restrictions Planning Command MappingsConfiguring HP-UX Rbac Example Planning Results Configuring RolesCreating Roles Assigning Roles to Groups Configuring AuthorizationsAssigning Roles to Users Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Hierarchical Roles Example Roles Configuration in HP-UX Rbac B.11.23.02Overview Examples of Hierarchical RolesExample 3-1 The authadm Command Syntax Changes to the authadm Command for Hierarchical RolesExample 3-2 Example of the authadm Command Usage Hierarchical Roles ConsiderationsConfiguring HP-UX Rbac with Fine-Grained Privileges Matches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac with CompartmentsCommand GID Configuring HP-UX Rbac to Generate Audit TrailsProcedure for Auditing HP-UX Rbac Criteria Following is the privrun command syntax Using HP-UX Rbac# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Privrun -v Information Troubleshooting HP-UX RbacRbacdbchk Database Syntax Tool Fine-Grained Privileges Commands CommandsFine-Grained Privileges Fine-Grained Privileges ComponentsManpages Available PrivilegesFine-Grained Privileges Manpages Available PrivilegesOr launch policy Configuring Applications with Fine-Grained Privileges# setfilexsec options filename Privilege ModelCompound Privileges Troubleshooting Fine-Grained Privileges Fine-Grained Privileges in HP Serviceguard ClustersSecurity Implications of Fine-Grained Privileges Privilege Escalation# getprocxsec options pid Compartment Architecture CompartmentsCompartment Architecture Planning the Compartment Structure Default Compartment ConfigurationActivating Compartments Modifying Compartment Configuration# setrules -p # cmpttune -eCompartment Components Compartment Configuration FilesChanging Compartment Rules Changing Compartment NamesCompartment Configuration Files Compartment CommandsCompartment Commands Compartment ManpagesFile System Rules Compartment Rules and SyntaxCompartment Definition Permissionlist IPC RulesIPC mechanism in the current compartment Network RulesAccess Interface Miscellaneous RulesExample Rules File Configuring Applications in CompartmentsTroubleshooting Compartments # vhardlinks Configured rules are loaded into the kernelDo not configure standby LAN interfaces in a compartment Compartments in HP Serviceguard ClustersStandard Mode Security Extensions Configuration Files Configuring Systemwide AttributesSecurity Attributes and the User Database System Security AttributesManpages CommandsAttributes Troubleshooting the User Database Configuring Attributes in the User DatabaseAuditing Auditing ComponentsAuditing Your System Audit CommandsPlanning Your Auditing Implementation Enabling AuditingAUDEVENTARGS1 = -P -F -e admin -e login -e moddac # audevent -P -F -e admin -e login -e moddacMonitoring Audit Files #audsys -n -c primaryauditfile -sAuditing Users Guidelines for Administering Your Auditing SystemPerformance Considerations #audsys -fAuditing Events Audevent command optionsStreamlining Audit Log Data # /usr/sbin/userdbset -u user-nameAUDITFLAG=1Self-auditing processes Audit Log Files#/usr/sbin/audisp auditfile Configuring Audit Log FilesViewing Audit Logs Examples of Using the audisp Command Page Index SymbolsSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb