HP-UX Compartment Login Using Secure Shell (SSH)

ManualsBrandsHP ManualsSoftwareHP-UX 11i Security Containment Software

Compartment Login Using Secure Shell (SSH)

Executive Summary .............................................................................................................................. 2

Background ........................................................................................................................................ 2

Compartments ................................................................................................................................. 2

HP-UX Role-Based Access Control (HP-UX RBAC).................................................................................. 2

Configuring SSH for Compartment Login ................................................................................................ 2

Configure compartments for SSH ....................................................................................................... 3

Define a Dedicated Physical or Logical Interface for Each Compartment ................................................. 3

Network Configuration Considerations ........................................................................................... 4

Configuring Multiple Instances of SSH ................................................................................................ 4

Multi-intance sshd_config............................................................................................................... 4

Starting sshd in the Appropriate Compartment ............................................................................... 5

Running sshd in the INIT Compartment............................................................................................ 6

Configuring User Compartment Login Access Restrictions...................................................................... 6

Making the Configuration Persist Across System Reboot........................................................................ 6

Summary ............................................................................................................................................ 7

References .......................................................................................................................................... 7

Appendix A – Sample compartment definition for sshd............................................................................. 8

Appendix B – Sample sshd_config file.................................................................................................. 10

Appendix C – Sample /sbin/init.d/secsh.cmpt RC script........................................................................ 13

Summary of content (15 pages)

PAGE 1
Compartment Login Using Secure Shell (SSH) Executive Summary .............................................................................................................................. 2 Background ........................................................................................................................................ 2 Compartments .................................................................................................................................
PAGE 2
Executive Summary In many deployments where HP-UX Compartmentalization functionality is in use, users and administrators must log in to a compartment directly. A recent update to the Security Containment feature supports this by enabling you to set controls on those users who are allowed to login to a service running in a specified compartment.
PAGE 3
compartment and is bound to the associated address. Finally, appropriate sets of users are configured for authorized access to the various compartments. Configure compartments for SSH To allow sshd to run in the desired compartments, your configuration must include rules that allow sshd to function correctly, much like any other compartmentalized application.
PAGE 4
Network Configuration Considerations HP strongly recommends that every configured IP address have appropriate (separate) route information. If this is not the case, the network subsystem uses the default (primary) interface for routing, which can lead to unexpected behavior in network communication. It is possible to create multiple default route entries that use the same gateway address, but specify a different local interface (IP address).
PAGE 5
• ListenAddress specifies the local addresses that the sshd listens on. The default is to listen on all local addresses, but you must configure this parameter for the IP address associated with the compartment that sshd is running in. • PidFile specifies the process ID that the particular instance of sshd is running under. The location of this file must be different for each instance of sshd. Example: You plan to start two sshd instances in two different compartments: cmpt1 and cmpt2.
PAGE 6
Running sshd in the INIT Compartment You can retain an instance of sshd to run in the INIT compartment. Ensure that the instance of sshd running in INIT also has a dedicated IP address. If the instance of sshd running in INIT is configured to listen to INADDR_ANY, then it disrupts the communications for other instances of sshd. Configuring User Compartment Login Access Restrictions HP-UX Compartment Login (part of the ContainmentExt_B.11.31.
PAGE 7
Summary With the release of ContainmentExt B.11.31.01, all components are in place to support compartment login usage scenarios. The process of accessing a compartment is simplified, often to the point where users accessing a compartment are not aware that they have logged in to a protected environment. References To learn more about HP-UX 11i Security Containment, see the following documents: • HP-UX 11i Security Containment Administrator's Guide: http://www.docs.hp.com/en/internet.
PAGE 8
Appendix A – Sample compartment definition for sshd compartment cmpt1 { /* * ** INTERFACE RULES ** * We recommend to configure a dedicated IP address to listen for * every instance of sshd running in the system. * The following rule has to be modified to configure the right * IP address. */ interface 192.1.1.10 /* * ** DISALLOWED PRIVILEGES RULES ** * sshd should not be allowed to do privileged operations such as * system reboot, security containment administration, etc.
PAGE 9
* System level security commands and authentication services require * following rule set */ perm read /etc/security.dsc perm read /etc/pam.
PAGE 10
Appendix B – Sample sshd_config file # $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $ # This is the sshd server system-wide configuration file. # sshd_config(5) for more information. See # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin:/opt/ssh/bin # # # # The strategy used for options in the default sshd_config shipped with OpenSSH is to specify options with their default value where possible, but leave them commented. Uncommented options change a default value.
PAGE 11
#RSAAuthentication yes #PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /opt/ssh/etc/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.
PAGE 12
# disable hpn performance boosts.
PAGE 13
Appendix C – Sample /sbin/init.d/secsh.cmpt RC script This sample RC script helps to start and stop an instance of sshd running in compartment cmpt1 and cmpt2 using the compartment specific sshd configuration file. #!/sbin/sh # # # List of compartments where sshd needs to be started. Also configure # the sshd configuration file for every compartment. # Set the MAX_INDEX as per the array size.
PAGE 14
set_return() { x=$? if [ $x -ne 0 ]; then echo "EXIT CODE: $x" rval=1 # script FAILed fi } case $1 in 'start_msg') echo "Starting $WHAT" ;; 'stop_msg') echo "Stopping $WHAT" ;; 'start') if [ -f $WHAT_CONFIG ] ; then .
PAGE 15
echo "usage: $0 {start|stop|start_msg|stop_msg}" rval=1 ;; esac exit $rval © 2008 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.