HP UX Security Products and Features Software specification

5.5 Rebooting to restricted mode

WLI installs and configures when security mode is set to maintenance. This mode disables all WLI file and resource protection, allowing the installer to complete all the previous steps.

After all administrator keys are authorized and a WLI database backup is generated, the system can be rebooted for WLI to operate in restricted mode:

%wlisyspolicy -s mode=restricted -k <wli_admin_key> The following must be executed by root user:

#shutdown -r

Following reboot, WLI is completely operational in the secure restricted mode.

5.5 Rebooting to restricted mode 27

Image 27

HP UX Security Products and Features Software manual Rebooting to restricted mode

Contents

HP-UX Whitelisting A.01.00 Administrator Guide Copyright 2010 Hewlett-Packard Development Company, L.P Table of Contents HP Serviceguard considerations Glossary Index List of Figures List of Examples Page Security features File access policiesFile lock access controls Capabilities Identity-based access controls 4 api Page WLI architecture Product overview Application API Commands Applications WLI metadata files WLI database 3 .$WLISIGNATURE$ Page Generating keys Key usage User keys Administrator keys Installing, removing, and upgrading Installation requirementsInstalling WLI Removing WLI Upgrading WLI Page Configuring Authorizing the recovery keyAuthorizing administrator keys Backing up the WLI database Signing DLKMs Rebooting to restricted mode Page Enhancing security with WLI Signing an executable binaryCreating a Flac policy Removing a file access policy Enabling DLKMs to load during bootCreating an Ibac policy # kcmodule ciss=unused # wlisign -a -k /home/admin1/adminpriv /usr/conf/mod/cissWlisign -a -k adminpriv /usr/sbin/kcmodule Loading unsigned DLKMsPage Backup and restore considerations OverviewWLI database files Recommendations Policy protected and metadata filesWrite protected Read/write protected files Flac policies Ibac policiesMetadata files Page HP Serviceguard considerations AdministrationWLI database Policy protected files Lost WLI administrator key or passphrase Troubleshooting and known issuesSoftware distributor issues WLI reinstallation # kcmodule wli=unused # shutdown -r Wlisyspolicy -s mode=maintenance -k adminkeySu root # rm -r /etc/wli # tar -xf /tmp/wlikeydb.tar Support and other resources Contacting HPRelated information Typographic conventions WebsitesUser input Times Page # su wliusr1 # make cleanInstructions # make all Ibac add and delete program Flac add and delete program Ibac add and delete program Page Administration examples Su root # wlisign -a -k adm1.pvt /usr/bin/tar Wlicert -s -c wli.admin1 -o wmd -k adm1.pvt Wlisys -k adm1.pvt -s wmdstoretype=pseudo Tar -vtf tartest.tarBdf mydir Cat /tmp/.$WLIFSPARMS$ Bprestore -f backuplist Bpbackup -f backuplist Authorizing a user key Quick setup examplesConfiguring WLI Authorizing an administrator key Enabling a Flac policy Testing a Flac policyFlac policies Creating a Flac policy Ibac policies Removing an Ibac policy Disabling an Ibac policy ASM GlossaryPage Index Symbols Index