Securing Virtual Partitions with HP-UX Role-Based Access Control

ManualsBrandsHP ManualsSoftwareHP-UX 11i v1.6 Technical Computing (TCOE) LTU

Securing Virtual Partitions with

HP-UX Role-Based Access Control

Document Information .......................................................................................................................... 3

Scope............................................................................................................................................. 3

Intended Audience ........................................................................................................................... 3

Terms and Definitions ....................................................................................................................... 3

Introduction......................................................................................................................................... 4

Partitioning Security Concerns ........................................................................................................... 4

Built-in vPars Security Features ........................................................................................................... 4

Possible Approaches to Enhance Virtual Partition Security Management ................................................. 4

HP-UX RBAC Overview......................................................................................................................... 6

Access Control Basics....................................................................................................................... 6

Simplifying Access Control with Roles................................................................................................. 6

The vPars with RBAC Solution................................................................................................................ 7

Planning HP-UX RBAC Deployment ........................................................................................................ 8

Step 1: Defining Roles for Users......................................................................................................... 8

Step 2: Defining Authorizations ......................................................................................................... 8

Step 3: Planning Command Mappings ...............................................................................................8

Configuring HP-UX RBAC...................................................................................................................... 9

Step 1: Configuring Roles for Users.................................................................................................... 9

Creating Roles ............................................................................................................................. 9

Assigning Roles to Users................................................................................................................ 9

Step 2: Configuring Authorizations .................................................................................................. 10

Step 3: Configuring Additional Command Authorizations and Privileges .............................................. 10

Using HP-UX RBAC ............................................................................................................................ 12

Using the privrun Command to Run Applications with Privileges .......................................................... 12

Conclusion........................................................................................................................................ 13

For More Information ......................................................................................................................... 14

Call to Action.................................................................................................................................... 14

Summary of content (14 pages)

PAGE 1
Securing Virtual Partitions with HP-UX Role-Based Access Control Document Information .......................................................................................................................... 3 Scope............................................................................................................................................. 3 Intended Audience ...........................................................................................................................
PAGE 2
-This page intentionally left blank- 2
PAGE 3
Document Information This White Paper from the Hewlett-Packard Company describes an approach to securing Virtual Partitions using the HP-UX Role-Based Access Control (RBAC) feature. Scope The solution described in this paper applies to HP-UX 11i v2 (11.23) only, as HP-UX RBAC is currently available starting with HP-UX 11i v2. While the solution in this paper does not cover HP-UX 11i v1 (11.11), a similar solution could be implemented using System Insight Manager or sudo instead of HPUX RBAC.
PAGE 4
Introduction Virtual Partitions (vPars) on HP-UX 11i v2 enables an enterprise to run multiple instances of the HP-UX 11i Operating Environment (OE) simultaneously on one server. With vPars, each OE instance hosts its own set of applications in a software isolated environment.
PAGE 5
virtual partitions on a single box are administered by multiple root users who do not share a trust relationship. For example, it might not be desirable for a root user on one virtual partition to reset another virtual partition. In this scenario, the existing virtual partition management commands should be supplemented to ensure that the administrative user on one virtual partition is not able to affect the operation of other virtual partitions.
PAGE 6
HP-UX RBAC Overview Ideally, each user should be assigned a set of tasks they are permitted to perform. Administrative tasks could then be performed by ordinary—but appropriately configured—user accounts. This would help preserve the “Principle of Least Privilege” while also retaining individual accountability. The HP-UX RBAC feature achieves these goals.
PAGE 7
The vPars with RBAC Solution In typical vPars deployment environments, there are usually two types of administrative roles. For the purposes of clarity in this document, we will refer to these two types of administrative roles as “Operator” and “BoxAdmin”. • Operator: someone who administers a particular virtual partition, typically running as the root user. • BoxAdmin: someone who manages the entire system and has physical access to each virtual partition.
PAGE 8
Planning HP-UX RBAC Deployment The information in the following sections explain the steps to deploy HP-UX RBAC for securing virtual partitions. Step 1: Defining Roles for Users The first step in using HP-UX RBAC to secure vPars is to plan an appropriate set of roles for the users of the target system.
PAGE 9
Configuring HP-UX RBAC Once your planning is complete, physically configuring the roles, authorizations, and commands is relatively straightforward and consists of the following three steps: 1. Configuring roles for users 2. Configuring authorizations 3.
PAGE 10
Step 2: Configuring Authorizations Configuring authorizations is similar to creating and assigning roles. However, authorizations contain two elements: an operation and an object. Use the authadm command to edit authorization information in the HP-UX RBAC databases. The following examples show the creation and assignment of the authorizations identified in the planning sections: # authadm add hpux.vpar.admin local authadm added auth: (hpux.vpar.admin,local) # authadm assign BoxAdmin “hpux.
PAGE 11
Note that similar configurations can be made for other virtual partition commands.
PAGE 12
Using HP-UX RBAC The information in this section explains how to operate HP-UX RBAC by using the privrun command to run existing legacy applications without modification and with varying privileges based on user authorizations Using the privrun Command to Run Applications with Privileges The privrun command enables a user to run legacy applications with different privileges, according to the authorizations associated with the invoking user.
PAGE 13
Conclusion In certain environments where virtual partitions are under different administrative domains, the ability of a root user of one virtual partition to affect the running of another virtual partition may need to be constrained. This can be achieved using HP-UX RBAC, which provides an alternative to the traditional "all-or-nothing" root user model. HP-UX RBAC allows you to distribute administrative responsibilities by creating roles with appropriate authorizations and assigning them to non-root users.
PAGE 14
For More Information The following list of references provides useful background information on related products and topics: • HP-UX Role-Based Access Control Product Documentation: http://docs.hp.com/hpux/internet/index.html#HP-UX%20Role-based%20Access%20Control • HP-UX RBAC manpages: o rbac(5): Overview and introduction of the RBAC product. o privrun(1m): Runs legacy applications with varying privileges that are based on authorizations associated with invoking user.