HP UX 11i Role-based Access Control (RBAC) Software specification

©Copyright 2007 Hewlett-Packard Development Company, L.P

Legal Notices

The information in this document is subject to change without notice.

Hewlett-Packard makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall not be held liable for errors contained herein or direct, indirect, special, incidental or consequential damages in connection with the furnishing, performance, or use of this material.

Warranty A copy of the specific warranty terms applicable to your Hewlett-Packard product and replacement parts can be obtained from your local Sales and Service Office.

U.S. Government License Proprietary computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license.

Trademark Notices UNIX® is a registered trademark in the United States and other countries, licensed exclusively through The Open Group.

Image 2

HP UX 11i Role-based Access Control (RBAC) Software manual Copyright 2007 Hewlett-Packard Development Company, L.P

Contents

HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page New and Changed Information in This Edition About This DocumentIntended Audience Publishing History UserInput Typographic ConventionsHP-UX Release Name and Release Identifier HP-UX 11i Releases Related InformationHP Encourages Your Comments Page Conceptual Overview AuthorizationHP-UX 11i Security Containment Introduction Account Policy Management Isolation Features and BenefitsDefined Terms Auditing Features Benefits Prerequisites and System Requirements InstallationInstalling HP-UX 11i Security Containment # swverify SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swlist -a state -l fileset SecurityExt Installing HP-UX Standard Mode Security Extensions Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation # swverify Rbac # swverify TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swlist -a state -l fileset TrustedMigration # swremove TrustedMigration Uninstalling HP-UX Standard Mode Security Extensions# swremove Rbac Page Overview HP-UX Role-Based Access ControlHP-UX Rbac Versus Other Rbac Solutions Example of Authorizations Per User Access Control BasicsSimplifying Access Control with Roles Example of Authorizations Per Role HP-UX Rbac Components HP-UX Rbac Commands HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac Configuration Files HP-UX Rbac Architecture HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac Manpages HP-UX Rbac Example Usage and Operation HP-UX Rbac Architecture Planning the Roles Planning Authorizations for the RolesPlanning the HP-UX Rbac Deployment Planning Command Mappings HP-UX Rbac Limitations and Restrictions Configuring HP-UX Rbac Example Planning Results Configuring RolesCreating Roles Assigning Roles to Groups Configuring AuthorizationsAssigning Roles to Users Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Overview Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles Examples of Hierarchical Roles Example 3-2 Example of the authadm Command Usage Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Hierarchical Roles Considerations Configuring HP-UX Rbac with Fine-Grained Privileges Matches the following /etc/rbac/cmdpriv entries Configuring HP-UX Rbac with CompartmentsCommand Configuring HP-UX Rbac to Generate Audit Trails GID Procedure for Auditing HP-UX Rbac Criteria Using HP-UX Rbac Following is the privrun command syntax # privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Privrun -v Information Troubleshooting HP-UX RbacRbacdbchk Database Syntax Tool Fine-Grained Privileges CommandsFine-Grained Privileges Commands Fine-Grained Privileges Components Fine-Grained Privileges Manpages Available PrivilegesManpages Available Privileges Configuring Applications with Fine-Grained Privileges Or launch policy # setfilexsec options filename Privilege ModelCompound Privileges Security Implications of Fine-Grained Privileges Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Privilege Escalation # getprocxsec options pid Compartments Compartment Architecture Compartment Architecture Default Compartment Configuration Planning the Compartment Structure # setrules -p Modifying Compartment ConfigurationActivating Compartments # cmpttune -e Changing Compartment Rules Compartment Configuration FilesCompartment Components Changing Compartment Names Compartment Commands Compartment CommandsCompartment Configuration Files Compartment Manpages File System Rules Compartment Rules and SyntaxCompartment Definition IPC Rules Permissionlist Network Rules IPC mechanism in the current compartment Access Miscellaneous Rules Interface Example Rules File Configuring Applications in CompartmentsTroubleshooting Compartments Configured rules are loaded into the kernel # vhardlinks Compartments in HP Serviceguard Clusters Do not configure standby LAN interfaces in a compartment Standard Mode Security Extensions Security Attributes and the User Database Configuring Systemwide AttributesConfiguration Files System Security Attributes Manpages CommandsAttributes Auditing Configuring Attributes in the User DatabaseTroubleshooting the User Database Auditing Components Planning Your Auditing Implementation Audit CommandsAuditing Your System Enabling Auditing Monitoring Audit Files # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac #audsys -n -c primaryauditfile -s Performance Considerations Guidelines for Administering Your Auditing SystemAuditing Users #audsys -f Streamlining Audit Log Data Audevent command optionsAuditing Events # /usr/sbin/userdbset -u user-nameAUDITFLAG=1 Audit Log Files Self-auditing processes #/usr/sbin/audisp auditfile Configuring Audit Log FilesViewing Audit Logs Examples of Using the audisp Command Page Symbols Index Security attribute defining