Managing Systems and Workgroups: A Guide for HP-UX System Administrators

Administering a System: Managing System Security
Managing Standard Passwords and System Access
Chapter 8 751
allowed to function as pseudo-accounts, with entries listed in
/etc/passwd. The customary pseudo- and special accounts are shown in
Figure 8-1 on page 751.
Figure 8-1 Pseudo- and Special System Accounts
root::0:3::/:/sbin/sh
daemon:*:1:5::/:/sbin/sh
bin:*:2:2::/usr/bin:/sbin/sh
sys:*:3:3::/:
adm:*:4:4::/var/adm:/sbin/sh
uucp:*:5:3::/var/spool/uucppublic:/usr/lbin/uucp/uucico
lp:*:9:7::/var/spool/lp:/sbin/sh
nuucp:*:11:11::/var/spool/uucppublic:/usr/lbin/uucp/uucico
hpdb:*:27:1:ALLBASE:/:/sbin/sh
nobody:*:-2:-2::/:
The key to the privileged status of these subsystems is their ability to
grant access to programs under their jurisdiction, without granting root
access (uid 0). Instead, the setuid bit for the executable file is set and the
effective user of the process corresponds to the owner of the executable
file. For example, the cancel command is part of the lp subsystem and
runs as effective user lp.
Once set, the security mediation of that subsystem enforces the security
of all programs encompassed by the subsystem, not the entire system.
Hence, the subsystem’s vulnerability to a breach of security is also
limited to only that subsystem files. Breaches cannot affect the programs
under different subsystems. For example, programs under lp do not
affect those under daemon.
System Access by Modem
To protect against system penetration via modem, observe these
precautions:
• Require the use of a hardware dial-back system for all interactive
modems.
• Require an additional password from modem users, by adding an
entry for the modem device in /etc/dialups and, optionally,
/etc/d_passwd.
• Have users renew their dial-in accounts frequently.