HP UX Security Products and Features Software instruction

HP-UX Whitelisting A.01.00 Administrator Guide

HP-UX 11iv3

HP Part Number: 5992-5210

Published: September 2010

Edition: 1

Image 1

HP UX Security Products and Features Software manual HP-UX Whitelisting A.01.00 Administrator Guide

Contents

HP-UX Whitelisting A.01.00 Administrator Guide Copyright 2010 Hewlett-Packard Development Company, L.P Table of Contents HP Serviceguard considerations Glossary Index List of Figures List of Examples Page File access policies Security featuresFile lock access controls Capabilities Identity-based access controls 4 api Page WLI architecture Product overview Application API Commands Applications WLI metadata files WLI database 3 .$WLISIGNATURE$ Page Generating keys Key usage User keys Administrator keys Installation requirements Installing, removing, and upgradingInstalling WLI Removing WLI Upgrading WLI Page Authorizing the recovery key ConfiguringAuthorizing administrator keys Backing up the WLI database Signing DLKMs Rebooting to restricted mode Page Signing an executable binary Enhancing security with WLICreating a Flac policy Enabling DLKMs to load during boot Removing a file access policyCreating an Ibac policy Wlisign -a -k adminpriv /usr/sbin/kcmodule # wlisign -a -k /home/admin1/adminpriv /usr/conf/mod/cissLoading unsigned DLKMs # kcmodule ciss=unusedPage Overview Backup and restore considerationsWLI database files Write protected Policy protected and metadata filesRead/write protected files Recommendations Ibac policies Flac policiesMetadata files Page Administration HP Serviceguard considerationsWLI database Policy protected files Software distributor issues Troubleshooting and known issuesWLI reinstallation Lost WLI administrator key or passphrase Su root # rm -r /etc/wli Wlisyspolicy -s mode=maintenance -k adminkey# tar -xf /tmp/wlikeydb.tar # kcmodule wli=unused # shutdown -r Contacting HP Support and other resourcesRelated information Websites Typographic conventionsUser input Times Page Instructions # make clean# make all # su wliusr1 Ibac add and delete program Flac add and delete program Ibac add and delete program Page Administration examples Su root # wlisign -a -k adm1.pvt /usr/bin/tar Wlicert -s -c wli.admin1 -o wmd -k adm1.pvt Bdf mydir Tar -vtf tartest.tarCat /tmp/.$WLIFSPARMS$ Wlisys -k adm1.pvt -s wmdstoretype=pseudo Bprestore -f backuplist Bpbackup -f backuplist Configuring WLI Quick setup examplesAuthorizing an administrator key Authorizing a user key Flac policies Testing a Flac policyCreating a Flac policy Enabling a Flac policy Ibac policies Removing an Ibac policy Disabling an Ibac policy ASM GlossaryPage Index Symbols Index