HP UX 11i Role-based Access Control (RBAC) Software Compartments in HP Serviceguard Clusters

Page 70

grant server tcp port 23 ifacelan0

If this rule is specified, it appears listed under the ifacelan0 compartment output of getrules.

ACCESS

PROTOCOL

SRCPORT

DESPORT

DESCMPT

Grant client

tcp

0

23

telnet

Compartments in HP Serviceguard Clusters

If you use compartments with HP Serviceguard, you must configure all Serviceguard daemons in the default INIT compartment. However, you can configure Serviceguard packages in other compartments. Refer to the latest editions of Managing Serviceguard and Using Serviceguard Extension for RAC for daemons required in Serviceguard and Serviceguard extensions for RAC cluster.

Serviceguard packages can belong to specific compartments. Applications monitored as part of a Serviceguard package can also be configured in specific compartments. When you set up the compartment for a package, be sure that the resources required by that package (such as volume groups, file systems, network addresses, and so on) are accessible by that compartment.

Compartment rules are node-specific and do not get carried over during Serviceguard failover operations. To ensure proper operation after a failover, all nodes in the cluster must have identical compartment configurations.

When a primary LAN interface fails over to a standby LAN interface, the compartment label of the primary interface is automatically copied over to the standby interface as long as the standby is not online. If the standby interface is already configured online, the standby interface and the primary interface must be configured in the same compartment to fail over successfully. If the standby interface is configured in a different compartment from the primary interface, but is offline at the time of the failover, the standby interface is updated to the primary interface compartment configuration when the interface fails over.

To maintain proper Serviceguard operations when deploying security containment features to HP Serviceguard nodes or packages:

Do not modify the INIT compartment specifications in any way.

Ensure inetd runs in the INIT compartment.

Ensure that all Serviceguard daemons in a cluster run in the INIT compartment. For example, the daemons for Serviceguard Version A.11.16 include cmclconfd, cmcld, cmlogd, cmlvmd, cmomd, and cmsnmpd. Refer to Managing Serviceguard for a list of all Serviceguard daemons.

Ensure that all Serviceguard cluster requirements are met for Serviceguard Extensions for RAC clusters. Additionally, clusters with Serviceguard Extension for RAC Version A.11.16 need the cmsmgd daemon to run in the INIT compartment. Oracle Real Application Cluster (RAC) processes must have access to the libnmapi2 library, and must communicate with cmsmgd. Refer to Using Serviceguard Extension for RAC for required daemons and libraries.

Do not configure standby LAN interfaces in a compartment.

Set up the compartments and rules identically on all nodes in the cluster. Compartments and rules are specific to a system and do not get carried over when a system fails over.

NOTE: If a standby interface is configured in a compartment, running the setrules command applies this compartment to the standby interface even if it has been successfully switched from a primary interface. If the configured standby interface compartment does not match the primary interface compartment, the primary interface compartment is overwritten when you run setrules. This can cause security violations.

There are no changes made to the Serviceguard scripts to facilitate the use of compartments, fine-grained privileges, or RBAC.

70 Compartments

Image 70
Contents HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page New and Changed Information in This Edition About This DocumentIntended Audience Publishing HistoryHP-UX Release Name and Release Identifier Typographic ConventionsUserInput HP Encourages Your Comments Related InformationHP-UX 11i Releases Page Conceptual Overview AuthorizationHP-UX 11i Security Containment Introduction Account Policy ManagementIsolation Features and BenefitsDefined Terms AuditingFeatures Benefits Installing HP-UX 11i Security Containment InstallationPrerequisites and System Requirements # swverify SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swlist -a state -l fileset SecurityExtInstalling HP-UX Standard Mode Security Extensions Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation # swverify Rbac# swverify TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swlist -a state -l fileset TrustedMigration# swremove Rbac Uninstalling HP-UX Standard Mode Security Extensions# swremove TrustedMigration Page HP-UX Rbac Versus Other Rbac Solutions HP-UX Role-Based Access ControlOverview Simplifying Access Control with Roles Access Control BasicsExample of Authorizations Per User Example of Authorizations Per Role HP-UX Rbac ComponentsHP-UX Rbac Commands HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac Configuration FilesHP-UX Rbac Architecture HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac ManpagesHP-UX Rbac Example Usage and Operation HP-UX Rbac ArchitecturePlanning the HP-UX Rbac Deployment Planning Authorizations for the RolesPlanning the Roles Planning Command Mappings HP-UX Rbac Limitations and RestrictionsConfiguring HP-UX Rbac Creating Roles Configuring RolesExample Planning Results Assigning Roles to Users Configuring AuthorizationsAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Overview Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles Examples of Hierarchical RolesExample 3-2 Example of the authadm Command Usage Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Hierarchical Roles ConsiderationsConfiguring HP-UX Rbac with Fine-Grained Privileges Command Configuring HP-UX Rbac with CompartmentsMatches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac to Generate Audit Trails GIDProcedure for Auditing HP-UX Rbac Criteria Using HP-UX Rbac Following is the privrun command syntax# privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Rbacdbchk Database Syntax Tool Troubleshooting HP-UX RbacPrivrun -v Information Fine-Grained Privileges CommandsFine-Grained Privileges Commands Fine-Grained Privileges ComponentsFine-Grained Privileges Manpages Available PrivilegesManpages Available PrivilegesConfiguring Applications with Fine-Grained Privileges Or launch policyCompound Privileges Privilege Model# setfilexsec options filename Security Implications of Fine-Grained Privileges Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Privilege Escalation# getprocxsec options pid Compartments Compartment ArchitectureCompartment Architecture Default Compartment Configuration Planning the Compartment Structure# setrules -p Modifying Compartment ConfigurationActivating Compartments # cmpttune -eChanging Compartment Rules Compartment Configuration FilesCompartment Components Changing Compartment NamesCompartment Commands Compartment CommandsCompartment Configuration Files Compartment ManpagesCompartment Definition Compartment Rules and SyntaxFile System Rules IPC Rules PermissionlistNetwork Rules IPC mechanism in the current compartmentAccess Miscellaneous Rules InterfaceTroubleshooting Compartments Configuring Applications in CompartmentsExample Rules File Configured rules are loaded into the kernel # vhardlinksCompartments in HP Serviceguard Clusters Do not configure standby LAN interfaces in a compartmentStandard Mode Security Extensions Security Attributes and the User Database Configuring Systemwide AttributesConfiguration Files System Security AttributesAttributes CommandsManpages Auditing Configuring Attributes in the User DatabaseTroubleshooting the User Database Auditing ComponentsPlanning Your Auditing Implementation Audit CommandsAuditing Your System Enabling AuditingMonitoring Audit Files # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac #audsys -n -c primaryauditfile -sPerformance Considerations Guidelines for Administering Your Auditing SystemAuditing Users #audsys -fStreamlining Audit Log Data Audevent command optionsAuditing Events # /usr/sbin/userdbset -u user-nameAUDITFLAG=1Audit Log Files Self-auditing processesViewing Audit Logs Configuring Audit Log Files#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Symbols IndexSecurity attribute defining
Related manuals
Manual 10 pages 36.76 Kb