Visit Our UNIX and Linux User Community


RBAC related question.....


 
Thread Tools Search this Thread
Operating Systems Solaris RBAC related question.....
# 1  
Old 07-19-2009
RBAC related question.....

I am referring Bill Calkins(SCSA exam prep) for RBAC..actually i wanted to make a normal user to get the privilege to run a command through authorization, not through profile files...
This is the exact steps given by Bill calkins..


1.roleadd -m -d /export/home/adminusr -c "Admin Assistant" \
-A solaris.admin.usermgr.pswd,solaris.system.shutdown,\
solaris.admin.fsmgr.write adminusr
2.
passwd adminusr
3.
usermod -R adminusr neil
4.su - neil
5.$roles
adminusr
6.su - adminusr

Now, neil can change passwords, shutdown system, share filesystems...
This is what Bill Calkins says...

but when i do this as neil..for eg.
$su - adminusr
passwd:****
passwd:****
$/usr/sbin/shutdown -h now
Only root can run /usr/sbin/shutdown...

Please let me know where I am going wrong...


Last edited by saagar; 07-19-2009 at 08:22 AM..
# 2  
Old 07-19-2009
you need to take the role as "adminuser" as far as i know... try a "su - adminuser" and test again.

---------- Post updated at 11:05 ---------- Previous update was at 11:04 ----------

To keep the forums high quality for all users, please take the time to format your posts correctly.

First of all, use Code Tags when you post any code or data samples so others can easily read your code. You can easily do this by highlighting your code and then clicking on the # in the editing menu. (You can also type code tags [code] and [/code] by hand.)

Second, avoid adding color or different fonts and font size to your posts. Selective use of color to highlight a single word or phrase can be useful at times, but using color, in general, makes the forums harder to read, especially bright colors like red.

Third, be careful when you cut-and-paste, edit any odd characters and make sure all links are working property.

Thank You.

The UNIX and Linux Forums
# 3  
Old 07-19-2009
Quote:
Originally Posted by saagar
I am referring Bill Calkins(SCSA exam prep) for RBAC..actually i wanted to make a normal user to get the privilege to run a command through authorization, not through profile files...
This is the exact steps given by Bill calkins..


1.roleadd -m -d /export/home/adminusr -c "Admin Assistant" \
-A solaris.admin.usermgr.pswd,solaris.system.shutdown,\
solaris.admin.fsmgr.write adminusr
2.
passwd adminusr
3.
usermod -R adminusr neil
4.su - neil
5.$roles
adminusr
6.su - adminusr

Now, neil can change passwords, shutdown system, share filesystems...
This is what Bill Calkins says...

but when i do this as neil..for eg.
$su - adminusr
passwd:****
passwd:****
$/usr/sbin/shutdown -h now
Only root can run /usr/sbin/shutdown...

Please let me know where I am going wrong...

Hi,
let me see /etc/user_attr file.


Good luck
# 4  
Old 07-19-2009
Quote:
Originally Posted by saagar
I am referring Bill Calkins(SCSA exam prep) for RBAC..actually i wanted to make a normal user to get the privilege to run a command through authorization, not through profile files...
This is the exact steps given by Bill calkins..


1.roleadd -m -d /export/home/adminusr -c "Admin Assistant" \
-A solaris.admin.usermgr.pswd,solaris.system.shutdown,\
solaris.admin.fsmgr.write adminusr
2.
passwd adminusr
3.
usermod -R adminusr neil
4.su - neil
5.$roles
adminusr
6.su - adminusr

Now, neil can change passwords, shutdown system, share filesystems...
This is what Bill Calkins says...

but when i do this as neil..for eg.
$su - adminusr
passwd:****
passwd:****
$/usr/sbin/shutdown -h now
Only root can run /usr/sbin/shutdown...

Please let me know where I am going wrong...

You forgot one small thing... pfexec
$ pfexec shutdown -h now
and it should work
# 5  
Old 07-20-2009
It isn't required to use pfexec here. However, the book example just doesn't allow to reboot as it doesn't apply to stock Solaris but Trusted Solaris extension only.
# 6  
Old 07-20-2009
Quote:
Originally Posted by samar
Hi,
let me see /etc/user_attr file.

Good luck
so i dont know how u managed that,i suspect that executive attribution has not given correct for your role that it cant execute "shutdown",
but example shown below works 100% :

# useradd -m -d /export/home/testuser testuser
64 blocks
# passwd testuser
New Password:
Re-enter new Password:
passwd: password successfully changed for testuser
# grep testuser /etc/passwd
testuser:x:60004:1::/export/home/testuser:/bin/sh
# roleadd -m -d /export/home/shutdown shutdown
64 blocks
# passwd shutdown
New Password:
Re-enter new Password:
passwd: password successfully changed for shutdown
# grep shutdown /etc/passwd
shutdown:x:60005:1::/export/home/shutdown:/bin/pfsh
# usermod -R shutdown testuser
# grep testuser /etc/user_attr
testuser::::type=normal;roles=shutdown

#echo "SHUTDOWN::Smilierofile to shutdown:help=shutdown.html" > /etc/security/prof_attr
#rolemod -P SHUTDOWN shutdown
#echo "SHUTDOWN:suser:cmd:::/usr/sbin/shutdown:uid=0" > /etc/security/exec_attr

-----------------------------------------------------

login as: testuser
Using keyboard-interactive authentication.
Password:
Last login: Mon Jul 20 12:36:57 2009 from 10.10.1.231
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
$ su - shutdown
Password:
$ /usr/sbin/shutdown

hutdown started. Mon Jul 20 12:53:22 GET 2009

Broadcast Message from root (pts/2) on gantek4 Mon Jul 20 12:53:22...
The system gantek4 will be shut down in 1 minute

showmount: gantek4: RPC: Program not registered
Broadcast Message from root (pts/2) on gantek4 Mon Jul 20 12:53:52...
The system gantek4 will be shut down in 30 seconds


Good luck
# 7  
Old 07-20-2009
Quote:
Originally Posted by samar
i suspect that executive attribution has not given correct for your role that it cant execute "shutdown"
No, it simply can't work. The book example is wrong in the sense authorizations can't grant a role to shutdown with regular Solaris.
The workaround is to use profiles like you do.

Previous Thread | Next Thread
Test Your Knowledge in Computers #344
Difficulty: Medium
In February 2005, Sun announced the Sun Grid, a grid computing deployment on which it offered utility computing services priced at US$2 per CPU/hour for processing and per GB/month for storage.
True or False?

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Question related to grep

We have huge file with control A as delimiter. Somehow one record is corrupted. This time i figured it out using ETL graph. If future , how to print only bad record. Example Correct record:... (2 Replies)
Discussion started by: srikanth38
2 Replies

2. Shell Programming and Scripting

awk related question

awk -F ";" 'FNR==NR{a=$1;next} ($2 in a)' server.list datafile | while read line do echo ${line} done when i run the above, i get this: 1 SERVICE NOTIFICATION: nagiosadmin skysmart-01.sky.net .... instead of: SERVICE NOTIFICATION: nagiosadmin skysmart-01.sky.net .... can... (4 Replies)
Discussion started by: SkySmart
4 Replies

3. UNIX for Dummies Questions & Answers

Question related to 'ps'

If I run a script called 'abc.sh' and then execute the following : ps -ef | grep 'abc.sh' I always get two rows of output, one for the executing script, and the other for the grep command that I have triggered after the pipe. Questions: Why does the second row turn up in the results. My... (10 Replies)
Discussion started by: jawsnnn
10 Replies

4. Shell Programming and Scripting

awk related question

awk "/^<Mar 31, 2012 : /,0" /app/blah.log can someone please help me figure out why the above command isn't pulling anything out from the log? basically, i want it to pull out all records, from the very first line that starts with the date "Mar 31, 2012" and that also has a time immediately... (4 Replies)
Discussion started by: SkySmart
4 Replies

5. Shell Programming and Scripting

having df command related question

Hi All, When i have run the below command its showing 90% which is critical for production. for this i need the answer of some below question please help me for that. 1) i want to delete some unwanted files. how can i know the unwanted files ?Is it there any way of knowing this?? 2)and... (2 Replies)
Discussion started by: aish11
2 Replies

6. HP-UX

RBAC question

hi every one i tried rbac and i made 1- role called GizaRoot 2- group called gizagroup 3- added privlage autherization called "m.k" /usr/sbin/useradd:dflt:(m.k,*):0/0//:dflt:dflt:dflt: i assigned the role to group and add user to that group then su to user and tried to use the command ... (0 Replies)
Discussion started by: maxim42
0 Replies

7. AIX

RBAC in 5.3 Question

I would like to use the Role Based access control to granulize some of the administration of AIX systems in our organization. Across the company we will be using aix 5.3. One of these roles will only have the access to make, change and delete users, something similar to ManageAllUsers. The thing... (1 Reply)
Discussion started by: dgaixsysadm
1 Replies

8. UNIX for Advanced & Expert Users

One Question related to alias

Hello, I have created following alias in csh lab 'rlogin -l user23 complab23' but problem is complab23 does not allow automatic login by checking .rhosts file. So after typing lab on command line I have to type complicate password and if wrong password is typed thrice then account gets... (4 Replies)
Discussion started by: neerajrathi2
4 Replies

9. Programming

signals related question

Hi all, Just a little question relative to signals. I know that if an application is in the sleep state, When a signal is catched, it will be processed by the handler. But what happens if it's processing something? Does the processing stops?? The following code should illustrate this case ... (2 Replies)
Discussion started by: ninjanesto
2 Replies

10. UNIX for Dummies Questions & Answers

A Question related to the net

well, I was suggested to remove the contents of the cache as i get out of the browser netscape from the .netscape folder. is that really necessary? if so what are the rest to be done? can anybody please tell me?:rolleyes: (8 Replies)
Discussion started by: sskb
8 Replies

Featured Tech Videos