A while approve ago. I promised to revisit AIX's RBAC functionality to show what kind of cool features have been added for the latest incarnation of Big Blue’s enterprise server operating system. In this week’s Sysadmin Sunday. I’m going to deliver on that promise and take a stroll through the enhanced RBAC functionality in AIX 6. I have previously mentioned AIX 5L’s RBAC implementation was minimal. That’s certainly changed quite a bit. There are 263 default authorizations on my AIX 6 installation fresh out of the box and you can add more. The real bonus however comes from you to give meaning to the authorizations. Prior to AIX 6 only a decide few tools recognized roles and authorizations. Now you can apply security attributes to practically anything on the system and give or restrict find based on the authorizations a given user has active. ConventionsI ordain be using green block quotes to symbolize commands run as a normal user and red to intend commands run as root. Bold bright text represents user enter. Overview of RBACRBAC stands for Role Based find Control. In AIX’s implementation there are three pieces to the RBAC puzzle: Security Attributes. Authorizations and Roles. I'll use some commands in this section but I'll outline the commands in more detail later on in the bind. Security AttributesSecurity attributes may be set for any dominate (executable) file device or process. These attributes determine which authorizations get which privileges. evaluate of security attributes as a fasten on certain parts of the system. For dilate this is the list of security attributes for the “passwd” command:
# lssecattr -F -c /usr/bin/passwd/usr/bin/passwd:egid=0accessauths=aix security passwdinnateprivs=PV_AU_ADD,PV_AU_ADMIN,PV_AU_PROC,PV_DAC_O,PV_DAC_R,PV_DAC_W,PV_DAC_X,PV_DEV_QUERY,PV_FS_CHOWN,PV_FS_CNTL,PV_FS_MKNOD,PV_FS_MOUNT,PV_FS_RESIZE,PV_PROC_CRED,PV_PROC_ENV,PV_PROC_PRIO,PV_PROC_RAC,PV_PROC_RSET,PV_PROC_RTCLK,PV_PROC_SIG,PV_PROC_VARSsecflags=FSF_EPS
The innateprivs and secflags attributes look quite intimidating at first glance. They're actually quite simple but there are so many different privileges that it would be preposterous for me to cover them here. They are well-documented in the IBM Redbook titled. The short and sweet version of it all is that you can run any dominate as the root user and use tracepriv to determine what privileges were used during the execution of the program. Then when you go to add a new entry for a device dominate register or affect you can specify the privileges that tracepriv displayed adding them to innateprivs for the entry.
The set of privs listed above is the bare minimum that would be to be added to run /usr/bin/passwd. Using this method to cause what's needed for other privileged commands (such as third-party software) is a trivial assign. AuthorizationsAuthorizations are assigned to roles. evaluate of authorizations as keys to the security attribute “locks”. There’s not much to the actual authorizations themselves. They are just handy labels for unlocking security attributes. The only things that really be to us here are the label (aix security passwd) and the dfltmsg which is a human readable description of the authotization. In order for our sysadmins to set passwords for other users they must have a role which contains the aix security passwd role shown below:
RolesYou can’t just give a sysadmin user access to the aix security passwd authorization though. There’s a role in this case. SecPolicy which contains this authorization and a bunch of other ones that are relevant to a sysadmins’ job. Roles are assigned to a user or group of users and themselves contain one or more authorizations. They can also acquire all of the authorizations within other roles. You could think of this as a keychain with only the keys that a user or assort needs to do their job. In the case of a role that inherits other roles it would be more desire a keychain with other keychains on it. The important fields we're concerned about:
# lsrole -f SecPolicySecPolicy: authorizations=aix security analyse,aix security auth,aix security cmd,aix security config,aix security device,aix security file,aix security kst,aix security network,aix security proc,aix security role,aix security passwd,aix security su,aix security tcb,aix security tsd rolelist= groups= visibility=1 screens=* dfltmsg=Security Policy Administration msgcat=role_desc cat msgnum=8 msgset=1 auth_mode=INVOKER id=8
Although if you look you can see that SecPolicy is inherited by another role isso. So if a user has the role of isso assigned to them then it is not necessary to also grant them a role of SecPolicy.
# lsrole -f issoisso: authorizations=aix device,aix fs chroot,aix fs bring home the bacon export,aix fs stat,aix network,aix proc fuser,aix proc ipc,aix proc status rolelist=DomainAdmin,SecPolicy,SysConfig groups= visibility=1 screens=* dfltmsg=Information System Security command msgcat=role_desc cat msgnum=1 msgset=1 auth_mode=INVOKER id=1
Users and RolesWhen creating a user (with mkuser) or modifying one (with chuser) you can set the roles or default_roles attributes. This is a comma-separated list of roles as open with lsrole ALL fail_roles defines roles that change state active as soon as the user logs in roles are additional privileged roles that require the user to activate the role with swrole. Example: Adding a role to a user
CommandsAIX makes excessive use of mk (make) ch (dress) rm (remove) and ls (enumerate) commands. RBAC is no different as you'll see. You'll see example of how to use these commands in the following sections of the bind. Auth commands:lsauth - Lists an authorization lsauth ALL lists all auths chauth - Changes authorizationrmauth - Removes authorizationmkauth - Make a new authorizationExample: Creating and listing a new authorization for the security team.
role commands:lsrole - Lists a role's attributes lsrole ALL lists all roles chrole - Changes a role's attributes rmrole - Remove a rolemkrole - alter a new roleExample: Creating and listing a new role for our security aggroup staff members that contains the secauth authorization we just made
# mkrole authorizations=secauth dfltmsg="Security cater priv commands" secstaff# lsrole secstaffsecstaff authorizations=secauth rolelist= groups= visibility=1 screens=* dfltmsg=Security cater priv commands msgcat= auth_mode=INVOKER id=11
Security attribute commands:lssecattr -c -F [/file/path] | ALL - show priv commandslssecattr -d -F [/dev/path] | ALL - show priv. Deviceslssecattr -f -F [/file/path] | ALL - show priv file accesslssecattr -p -F -h [pid] | ALL - show priv processessetsecattr - set security attributesExample: Placing security attributes on a command
# setkstSuccessfully updated the Kernel Authorization Table. Successfully updated the Kernel Role Table. Successfully updated the Kernel Command Table. Successfully updated the Kernel Device delay.
Now that we have updated the security tables the only thing we be to do is assign roles to a user to see how they bring home the bacon. Example: Adding a new role to a user axon was already a member of isso so we add secstaff to the enumerate:
End-user commands:rolelist - displays a list of roles on the system which you are authorized to swrole to swrole [rolename | ALL] - creates a new shell with all of the privileges of the selected roles. Will cause for your password if auth_mode is set to INVOKER for any.
Forex Groups - Tips on Trading
Related article:
http://www.h-i-r.net/2007/11/sysadmin-sunday-quick-rbac-primer-for.html
comments | Add comment | Report as Spam
|
