HP Open View Data Protector for Security Containment

ManualsBrandsHP ManualsSoftwareHP-UX 11i Security Containment Software

Introduction......................................................................................................................................... 2

HP Open View Storage Data Protector ................................................................................................... 2

Data Protector Concept ........................................................................................................................ 3

Security Containment Concepts ............................................................................................................. 3

Software Infrastructure.......................................................................................................................... 5

Writing Security Policy backup.............................................................................................................. 5

RBAC policy.................................................................................................................................... 6

Bastille Policy:.................................................................................................................................. 7

IP Filter Policy: ................................................................................................................................. 7

Appendix A ........................................................................................................................................ 8

For more information............................................................................................................................ 9

Summary of content (9 pages)

PAGE 1
HP Open View Data Protector for Security Containment Introduction......................................................................................................................................... 2 HP Open View Storage Data Protector ................................................................................................... 2 Data Protector Concept ........................................................................................................................
PAGE 2
Introduction This document helps you deploy a backup application in a Security Containment environment that will protect your backup applications from other application security threats. HP-UX Security Containment provides a highly secure operating system environment.
PAGE 3
Data Protector Concept A backup is a process that creates a copy of the data on a backup device. During backups on a network environment, the data is transferred over the network from systems that need to be backed up on systems with backup devices. A restore is a process that recreates the original data from a backup copy. This process consists of the preparation and actual restore of data, and some post-restore actions that make that data ready for use.
PAGE 4
Fine Grained Privileges Traditional UNIX operating systems grant "all or nothing" administrative privileges based on the effective UID of the process that is running. If the process is running with the effective UID=0, it is granted all privileges. With fine-grained privileges, processes are granted only the privileges needed for the task and, optionally, only for the time needed to complete the task.
PAGE 5
HP-UX Security Containment product. In this figure, the client system is configured with three different compartments: • Web server compartment • backup compartment • INIT, the default system compartment The Data Protector backup and restore agent’s runs in the backup compartment. Software Infrastructure Install Open View Data Protector software on the system designated as the Cell Manager.
PAGE 6
protector product. Therefore, the INIT compartment needs to be able to accept such incoming connections.
PAGE 7
# authadm add hpux.backupsw.omni # authadm assign DP hpux.backupsw.omni Add the cmd_priv entry such that the command gets executed with euid=ruid=0 with the compartment keyword backup. # cmdprivadm add cmd="/opt/omni/lbin/inet \ -log /var/opt/omni//log/inet.log" op=hpux.backupsw.omni \ compartment=backup euid=0 ruid=0 When the omni disk agent software gets installed, the following inet entry gets added to the /etc/inetd.
PAGE 8
Appendix A The following steps add a new authorization to view the processes running in the backup compartment: 1. Add the new authorization to view the processes running in the backup compartment, as follows: # authadm add hpux.backupsw.omni.ps 2. Assign the authorization to the role DP, as follows: # authadm assign DP hpux.backupsw.omni.ps 3. Add the cmdpriv entry,as follows: # cmdprivadm add cmd="/usr/bin/ps" op=hpux.backupsw.omni.ps \ compartment=backup 4.
PAGE 9
For more information You can find additional information about security and HP-UX at: http://docs.hp.com In particular, the following documents are available: • Bastille • IPFilter • Security Containment • HP-UX 11i Protected Systems Web Server • HP Open View Storage Data Protector Concepts Guide (B6960-96001) • HP Open View Storage Data Protector Installation and Licensing Guide © 2007 Hewlett-Packard Development Company, L.P.