Software Distributor (SD-UX) Administration Guide HP-UX 11i v1, 11i v2, and 11i v3 (762797-001, March 2014)

Local Superuser Authorization
As a special case, SD-UX always allows the local superuser full access to all local objects regardless
of ACL protections. This allows the local superuser to repair corrupted ACLs or to perform any
other operations.
Delegation
SD-UX provides a form of delegation to control access to depot-resident products: both the host
where the target agent is running and the user initiating the call must have read access.
This form of delegation passes the caller credential information to the depot agent in the RPC
options. This form of delegation works the same whether the agents are configured to use DCE or
SD-UX Internal authentication.
It is important to note that this delegation technique is provided to allow user-level access to
depot-resident products.
Depot Registration and Daemon/Agent Security
Because SD-UX stores its objects in the file system, someone could build a “Trojan Horse” file system
image of a software depot. This could breech the security of any system that installed products
from the false depot. To protect systems from such a situation, SD-UX requires that a depot be
registered with SD-UX (either through swcopy or by using swreg) before software may be installed
or copied from it. This check is always performed before granting access. Registration with swreg
requires insert permission in the host’s ACL.
As a special case, an unregistered depot may be used for local installation (i.e., the depot and
destination root exist on the same system) if the initiator is the local superuser or has permission
to register the depot (insert permission on the host).
The administrator of a host system must ensure the integrity of new depots before registering them
and ensure that only trustworthy users are granted permission to insert on the host.
NOTE: In addition to registering users, caution should be exercised when installing or copying
from unregistered depots.
Security Use Models
The use models below use the swadm group that is provided in the default host ACLs, which are
installed at SD-UX install-time. This group is not a part of the default HP-UX configuration, but can
be easily added. First, add the swadm group and the appropriate group members by using the
HP-UX System Administration Manager product. Next, provide the /etc/logingroup link to
/etc/group to activate HP-UX supplementary groups.
NOTE: /etc/logingroup is an HP-UX utility to support both SVR2/3 and BSD group semantics
selectively. When /etc/logingroup is linked to /etc/group, HP-UX gives BSD (and SVR4)
semantics.
If the file /etc/logingroup does not exist on systems targeted as SD-UX Controllers, execute
the following command (as superuser) on each appropriate system:
ln -s /etc/group /etc/logingroup
Security in Remote Distributions
A common use of SD-UX remote operations capabilities is for a software administrator to push
software from a local depot out to numerous remote targets.
You can set up of this kind of configuration:
Security Use Models 161