HP UX 11i Role-based Access Control (RBAC) Software instruction

16

Image 16

HP UX 11i Role-based Access Control (RBAC) Software manual

Contents

HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page About This Document Intended AudienceNew and Changed Information in This Edition Publishing History HP-UX Release Name and Release Identifier Typographic ConventionsUserInput HP Encourages Your Comments Related InformationHP-UX 11i Releases Page Authorization HP-UX 11i Security Containment IntroductionConceptual Overview Account Policy Management Features and Benefits Defined TermsIsolation Auditing Features Benefits Installing HP-UX 11i Security Containment InstallationPrerequisites and System Requirements Verifying the HP-UX 11i Security Containment Installation # swlist -d @ /tmp/securitycontainmentbundle.depot# swverify SecurityExt # swlist -a state -l fileset SecurityExt Installing HP-UX Role-Based Access Control Verifying the HP-UX Role-Based Access Control InstallationInstalling HP-UX Standard Mode Security Extensions # swverify Rbac Uninstalling HP-UX 11i Security Containment Uninstalling HP-UX Rbac# swverify TrustedMigration # swlist -a state -l fileset TrustedMigration # swremove Rbac Uninstalling HP-UX Standard Mode Security Extensions# swremove TrustedMigration Page HP-UX Rbac Versus Other Rbac Solutions HP-UX Role-Based Access ControlOverview Simplifying Access Control with Roles Access Control BasicsExample of Authorizations Per User Example of Authorizations Per Role HP-UX Rbac Components HP-UX Rbac Access Control Policy Switch HP-UX Rbac Configuration FilesHP-UX Rbac Commands HP-UX Rbac Configuration Files HP-UX Rbac Commands HP-UX Rbac ManpagesHP-UX Rbac Architecture HP-UX Rbac Manpages HP-UX Rbac Example Usage and Operation HP-UX Rbac Architecture Planning the HP-UX Rbac Deployment Planning Authorizations for the RolesPlanning the Roles Planning Command Mappings HP-UX Rbac Limitations and Restrictions Configuring HP-UX Rbac Creating Roles Configuring RolesExample Planning Results Assigning Roles to Users Configuring AuthorizationsAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Example Roles Configuration in HP-UX Rbac B.11.23.02 Hierarchical RolesOverview Examples of Hierarchical Roles Changes to the authadm Command for Hierarchical Roles Example 3-1 The authadm Command SyntaxExample 3-2 Example of the authadm Command Usage Hierarchical Roles Considerations Configuring HP-UX Rbac with Fine-Grained Privileges Command Configuring HP-UX Rbac with CompartmentsMatches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac to Generate Audit Trails GID Procedure for Auditing HP-UX Rbac Criteria Using HP-UX Rbac Following is the privrun command syntax # privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Rbacdbchk Database Syntax Tool Troubleshooting HP-UX RbacPrivrun -v Information Commands Fine-Grained Privileges CommandsFine-Grained Privileges Fine-Grained Privileges Components Available Privileges ManpagesFine-Grained Privileges Manpages Available Privileges Configuring Applications with Fine-Grained Privileges Or launch policy Compound Privileges Privilege Model# setfilexsec options filename Fine-Grained Privileges in HP Serviceguard Clusters Troubleshooting Fine-Grained PrivilegesSecurity Implications of Fine-Grained Privileges Privilege Escalation # getprocxsec options pid Compartments Compartment Architecture Compartment Architecture Default Compartment Configuration Planning the Compartment Structure Modifying Compartment Configuration Activating Compartments# setrules -p # cmpttune -e Compartment Configuration Files Compartment ComponentsChanging Compartment Rules Changing Compartment Names Compartment Commands Compartment Configuration FilesCompartment Commands Compartment Manpages Compartment Definition Compartment Rules and SyntaxFile System Rules IPC Rules Permissionlist Network Rules IPC mechanism in the current compartment Access Miscellaneous Rules Interface Troubleshooting Compartments Configuring Applications in CompartmentsExample Rules File Configured rules are loaded into the kernel # vhardlinks Compartments in HP Serviceguard Clusters Do not configure standby LAN interfaces in a compartment Standard Mode Security Extensions Configuring Systemwide Attributes Configuration FilesSecurity Attributes and the User Database System Security Attributes Attributes CommandsManpages Configuring Attributes in the User Database Troubleshooting the User DatabaseAuditing Auditing Components Audit Commands Auditing Your SystemPlanning Your Auditing Implementation Enabling Auditing # audevent -P -F -e admin -e login -e moddac AUDEVENTARGS1 = -P -F -e admin -e login -e moddacMonitoring Audit Files #audsys -n -c primaryauditfile -s Guidelines for Administering Your Auditing System Auditing UsersPerformance Considerations #audsys -f Audevent command options Auditing EventsStreamlining Audit Log Data # /usr/sbin/userdbset -u user-nameAUDITFLAG=1 Audit Log Files Self-auditing processes Viewing Audit Logs Configuring Audit Log Files#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Symbols Index Security attribute defining