HP UX 11i Role-based Access Control (RBAC) Software specs

Table of Contents
About This Document	13
Intended Audience	13
New and Changed Information in This Edition	13
Publishing History	13
Document Organization	13
Typographic Conventions	14
HP-UX Release Name and Release Identifier	14
Related Information	15
HP Encourages Your Comments	15
1 HP-UX 11i Security Containment Introduction	17
Conceptual Overview	17
Authorization	17
Account Policy Management	17
Privileges	17
Isolation	18
Auditing	18
Defined Terms	18
Features and Benefits	18
Features	19
Benefits	20
2 Installation	21
Prerequisites and System Requirements	21
Hardware	21
Software	21
Disk Space	21
Installing HP-UX 11i Security Containment	21
Verifying the HP-UX 11i Security Containment Installation	22
Installing HP-UXRole-Based Access Control	23
Verifying the HP-UXRole-Based Access Control Installation	23
Installing HP-UX Standard Mode Security Extensions	23
Verifying the HP-UX Standard Mode Security Extensions Installation	24
Uninstalling HP-UX 11i Security Containment	24
Uninstalling HP-UX RBAC	24
Uninstalling HP-UX Standard Mode Security Extensions	25
3 HP-UXRole-Based Access Control	27
Overview	27
HP-UX RBAC Versus Other RBAC Solutions	27
Access Control Basics	28
Simplifying Access Control with Roles	28
HP-UX RBAC Components	29
HP-UX RBAC Access Control Policy Switch	30
HP-UX RBAC Configuration Files	30
HP-UX RBAC Commands	30
HP-UX RBAC Manpages	31
HP-UX RBAC Architecture	31

Table of Contents

3

Image 3

HP UX 11i Role-based Access Control (RBAC) Software manual Table of Contents

Contents

HP-UX 11i Security Containment Administrators Guide Copyright 2007 Hewlett-Packard Development Company, L.P Table of Contents Fine-Grained Privileges Index Page List of Figures Page List of Tables Page List of Examples Page Publishing History About This DocumentIntended Audience New and Changed Information in This Edition Typographic Conventions HP-UX Release Name and Release IdentifierUserInput Related Information HP Encourages Your CommentsHP-UX 11i Releases Page Account Policy Management AuthorizationHP-UX 11i Security Containment Introduction Conceptual Overview Auditing Features and BenefitsDefined Terms Isolation Features Benefits Installation Installing HP-UX 11i Security ContainmentPrerequisites and System Requirements # swlist -a state -l fileset SecurityExt Verifying the HP-UX 11i Security Containment Installation# swlist -d @ /tmp/securitycontainmentbundle.depot # swverify SecurityExt # swverify Rbac Installing HP-UX Role-Based Access ControlVerifying the HP-UX Role-Based Access Control Installation Installing HP-UX Standard Mode Security Extensions # swlist -a state -l fileset TrustedMigration Uninstalling HP-UX 11i Security ContainmentUninstalling HP-UX Rbac # swverify TrustedMigration Uninstalling HP-UX Standard Mode Security Extensions # swremove Rbac# swremove TrustedMigration Page HP-UX Role-Based Access Control HP-UX Rbac Versus Other Rbac SolutionsOverview Access Control Basics Simplifying Access Control with RolesExample of Authorizations Per User HP-UX Rbac Components Example of Authorizations Per Role HP-UX Rbac Configuration Files HP-UX Rbac Access Control Policy SwitchHP-UX Rbac Configuration Files HP-UX Rbac Commands HP-UX Rbac Manpages HP-UX Rbac CommandsHP-UX Rbac Manpages HP-UX Rbac Architecture HP-UX Rbac Architecture HP-UX Rbac Example Usage and Operation Planning Authorizations for the Roles Planning the HP-UX Rbac DeploymentPlanning the Roles HP-UX Rbac Limitations and Restrictions Planning Command Mappings Configuring HP-UX Rbac Configuring Roles Creating RolesExample Planning Results Configuring Authorizations Assigning Roles to UsersAssigning Roles to Groups Configuring Additional Command Authorizations and Privileges Is mainly intended for scripts Examples of Hierarchical Roles Example Roles Configuration in HP-UX Rbac B.11.23.02Hierarchical Roles Overview Hierarchical Roles Considerations Changes to the authadm Command for Hierarchical RolesExample 3-1 The authadm Command Syntax Example 3-2 Example of the authadm Command Usage Configuring HP-UX Rbac with Fine-Grained Privileges Configuring HP-UX Rbac with Compartments CommandMatches the following /etc/rbac/cmdpriv entries GID Configuring HP-UX Rbac to Generate Audit Trails Procedure for Auditing HP-UX Rbac Criteria Following is the privrun command syntax Using HP-UX Rbac # privrun ipfstat HP-UX Rbac in Serviceguard Clusters Customizing privrun and privedit Using the Acps Troubleshooting HP-UX Rbac Rbacdbchk Database Syntax ToolPrivrun -v Information Fine-Grained Privileges Components CommandsFine-Grained Privileges Commands Fine-Grained Privileges Available Privileges Available PrivilegesManpages Fine-Grained Privileges Manpages Or launch policy Configuring Applications with Fine-Grained Privileges Privilege Model Compound Privileges# setfilexsec options filename Privilege Escalation Fine-Grained Privileges in HP Serviceguard ClustersTroubleshooting Fine-Grained Privileges Security Implications of Fine-Grained Privileges # getprocxsec options pid Compartment Architecture Compartments Compartment Architecture Planning the Compartment Structure Default Compartment Configuration # cmpttune -e Modifying Compartment ConfigurationActivating Compartments # setrules -p Changing Compartment Names Compartment Configuration FilesCompartment Components Changing Compartment Rules Compartment Manpages Compartment CommandsCompartment Configuration Files Compartment Commands Compartment Rules and Syntax Compartment DefinitionFile System Rules Permissionlist IPC Rules IPC mechanism in the current compartment Network Rules Access Interface Miscellaneous Rules Configuring Applications in Compartments Troubleshooting CompartmentsExample Rules File # vhardlinks Configured rules are loaded into the kernel Do not configure standby LAN interfaces in a compartment Compartments in HP Serviceguard Clusters Standard Mode Security Extensions System Security Attributes Configuring Systemwide AttributesConfiguration Files Security Attributes and the User Database Commands AttributesManpages Auditing Components Configuring Attributes in the User DatabaseTroubleshooting the User Database Auditing Enabling Auditing Audit CommandsAuditing Your System Planning Your Auditing Implementation #audsys -n -c primaryauditfile -s # audevent -P -F -e admin -e login -e moddacAUDEVENTARGS1 = -P -F -e admin -e login -e moddac Monitoring Audit Files #audsys -f Guidelines for Administering Your Auditing SystemAuditing Users Performance Considerations # /usr/sbin/userdbset -u user-nameAUDITFLAG=1 Audevent command optionsAuditing Events Streamlining Audit Log Data Self-auditing processes Audit Log Files Configuring Audit Log Files Viewing Audit Logs#/usr/sbin/audisp auditfile Examples of Using the audisp Command Page Index Symbols Security attribute defining