HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

8 HP-UX Role-Based Access Control
The information in this chapter describes HP-UX Role-Based Access Control (HP-UX
RBAC). This chapter addresses the following topics:
• Overview (Section 8.1)
• Access control basics (Section 8.2)
• HP-UX RBAC components (Section 8.3)
• Planning the HP-UX RBAC deployment (Section 8.4)
• Configuring HP-UX RBAC (Section 8.5)
• Using HP-UX RBAC (Section 8.6)
• Troubleshooting HP-UX RBAC (Section 8.7)
8.1 Overview
Security, especially platform security, has always been an important issue for enterprise
infrastructure. Even so, many organizations often neglected or overlooked such security
concepts as individual accountability and least privilege in the past. However, recently
introduced legislation in the United States including the Health Insurance Portability
and Accountability Act (HIPAA) and the Sarbanes-Oxley Act has helped to highlight
the importance of these security concepts.
Most enterprise environments have systems administered by multiple users. Typically,
this is accomplished by providing the administrators with the password to a common,
shared account, known as root. While the root account simplifies access control
management by enabling administrators with the root password to perform all
operations the root account also presents several inherent obstacles for access control
management, for example:
• After providing administrative users with the root password, there is no easy way
to further constrain those users.
• In the best case, revoking access for a single administrator requires changing the
common password and notifying other administrators. More realistically, simply
changing the password is probably not sufficient to effectively revoke access
because alternative access mechanisms might have already been implemented.
• Individual accountability with a shared root account is virtually impossible to
achieve. Consequently, proper analysis after a security event becomes difficult,
and in some cases impossible.
The HP-UX Role-Based Access Control (RBAC) feature resolves these obstacles by
providing the capability to assign sets of tasks to ordinary, but appropriately configured,
user accounts. HP-UX RBAC also mitigates the management overhead associated with
assigning and revoking individual authorizations on a per-user basis.
8.1 Overview 137