HP-UX Role-Based Access Control B.11.23.06 Release Notes

1 HP-UX RBAC
HP-UX RBAC is an alternative to the traditional “all-or-nothing” root user model, which grants
permissions to the root user for all operations, and denies permissions to non-root users for
certain operations. HP-UX RBAC allows you to distribute administrative responsibilities by
creating roles with appropriate authorizations and assigning them to non-root users and groups.
HP-UX RBAC includes the following main components:
• Privilege shells (privsh, privksh, and privcsh) that automatically invoke the access
control subsystem to run commands with privileges when appropriate.
• RBAC System Management Homepage (SMH) integration to allow the graphical management
of the RBAC databases through a Web interface.
• The privrun wrapper command that allows authorized users and groups to run existing
legacy applications with varying levels of privileges without modifying the application.
• The privedit command that allows authorized users and groups to edit files they normally
would not be able to edit because of file permissions or Access Control Lists.
• Customizable Access Control Policy Switch (ACPS) that determines whether a subject is
authorized to perform an operation on an object.
• Access Control Policy Module (ACPM) to evaluate HP-UX RBAC databases and service
access control requests.
• Management commands to edit and validate HP-UX RBAC database files.
1.1 HP-UX RBAC Features
HP-UX RBAC offers the following features:
• Integrates with the Fine-Grained Privileges and Compartments components of the HP-UX
11i Security Containment features.
• Integrates with HP-UX audit system to produce a single, unified audit trail.
• Pluggable architecture for customizing access control decisions and integrating existing
access control policy information.
• Pre-defined configuration files to facilitate quick and easy deployment.
• Flexible re-authentication ability via PAM to allow restrictions on a per command basis.
• Fully supported HP product.
NOTE: The HP-UX Identity Management Integration A.01.00 feature allows you to manage
HP-UX RBAC operations using the HP OpenView Select Access Policy Builder GUI.
To learn more about the HP-UX Identity Management Integration feature, select HP-UX Identity
Management Integration on Software Depot:
http://www.software.hp.com
1.2 Compatibility Information and Installation Requirements
The minimum requirements to install and run HP-UX RBAC B.11.23.06 are as follows:
• Hardware Requirements:
— HP 9000 Computers
— HP Integrity Servers
• Disk Space Requirements:
— 560 KB on HP 9000 Computers
— 900 KB on HP Integrity Servers
1.1 HP-UX RBAC Features 7