10 More Discussions You Might Find Interesting
1. Linux
When unlocking a Linux server's console there's no event indicating successful logging
Is there a way I can fix this ?
I have the following in my rsyslog.conf
auth.info /var/log/secure
authpriv.info /var/log/secure (1 Reply)
Discussion started by: walterthered
1 Replies
2. AIX
Hi all,
i have a little problem...
I have a Trusted AIX v. 6.1 installed on my system p.
I can't disable RBAC mode...
$ lsattr -El sys0 -a enhanced_RBAC
enhanced_RBAC true Enhanced RBAC Mode True
$ chdev -l sys0 -a enhanced_RBAC=false
Method error (/usr/lib/methods/chggen):
0514-018... (3 Replies)
Discussion started by: Zio Bill
3 Replies
3. Solaris
I'm trying to set up RBAC, and I need to know where the logs for RBAC are.
I'm using Solaris 10 as my OS.
I've been reading a lot of documents online and just can't seem to find where the related logs are.
My problem is I need to be able to track a user when they su to a role profile, and... (2 Replies)
Discussion started by: bitlord
2 Replies
4. HP-UX
hi every one i tried rbac and i made
1- role called GizaRoot
2- group called gizagroup
3- added privlage autherization called "m.k"
/usr/sbin/useradd:dflt:(m.k,*):0/0//:dflt:dflt:dflt:
i assigned the role to group and add user to that group then su to user and tried to use the command ... (0 Replies)
Discussion started by: maxim42
0 Replies
5. Solaris
Hi all!
On backup server with contab my script worked, but one command don't fine to be executed:
bash-3.00$ scp itadmin@172.17.0.44:/export/backups/* /bckp1/opencms/bcp_`date +%Y%m%d`/
www-zone.cfg 100%... (0 Replies)
Discussion started by: sotich82
0 Replies
6. UNIX for Dummies Questions & Answers
Can anyone help me on "How to change Unix to support RBAC policy"? (4 Replies)
Discussion started by: JPoroo
4 Replies
7. AIX
I would like to use the Role Based access control to granulize some of the administration of AIX systems in our organization. Across the company we will be using aix 5.3. One of these roles will only have the access to make, change and delete users, something similar to ManageAllUsers. The thing... (1 Reply)
Discussion started by: dgaixsysadm
1 Replies
8. Shell Programming and Scripting
what would be easier to automate a script if/then ? (0 Replies)
Discussion started by: deaconf19
0 Replies
9. Solaris
do i have to create a new account to add a role?
i want the sysadmin login
i have 3 users on my systems
sysadmin
secman
oc01
also 3 profiles
SA (goes t0 sysadmin account)
SSO (goes to secman account)
LMICS (goes to oc01 account)
the user accounts are located in /h/USERS/local
the... (4 Replies)
Discussion started by: deaconf19
4 Replies
10. Solaris
I am trying to let user asillitoe su to the godbrook role to execute commands. I have editted files as follows:
user_attr:
asillito::::type=normal;roles=godbrook
godbrook::::type=role;profiles=Gadbrook,All
prof_attr:
Gadbrook:::Allow root commands to be used by godbrook:
exec_attr:... (0 Replies)
Discussion started by: chrisdberry
0 Replies
authadm(1M) authadm(1M)
NAME
authadm - non-interactive command for administrating the authorization information in the RBAC databases
SYNOPSIS
[object [comments]]
[object]
operation [object]
subrole
DESCRIPTION
is a non-interactive command that allows users with the appropriate privileges to modify and list authorization information in the and RBAC
databases files.
HP recommends using only the and commands to edit and view the RBAC databases -- do not edit the RBAC files without these commands.
See rbac(5) for more information on these RBAC databases.
Options
With the exception of the option, all options recognize a default object. If the parameter is specified with a non-empty value in the
security default file, then the value of this parameter will be the default object. However, if the parameter does not exist or is set to
an empty value, then the default object will be set to a wild card (*).
Here is how to specify a value to the parameter in
For example: In sets the default object to If line is not present or is commented out, then the default object will be set to "*".
recognizes the following options:
Adds an authorization pair
(operation, object) to the system list of valid authorizations by appending a line to the file.
If object is not specified, then a default object will be assigned. The default object will either be a wild card (*) or the object
specified in the security default configuration file, A comment may not be specified when adding an entry that refers to the default
object in The only way to add a comment to an entry with the option is to specify the object explicitly.
Deletes an authorization from the system list of valid authorizations.
If object is not specified, then a default object will be assumed. The default object will either be a wild card (*) or the object
specified in the security default configuration file,
If the authorization exists in deletes the entry. If the specified authorization is assigned to any roles in will remove the autho-
rization from the role. If the specified authorization exists in an entry in will remove the entire entry. If the authorization
does not exist in returns an error message. See the section below for more information.
Assigns an authorization pair
to a role. verifies the role exists in before verifying the authorization pair exists in appends the authorization to the role to
authorization mapping in if the role and authorization pair exists.
If object is not specified, then a default object will be assigned. The default object will either be a wild card (*) or the object
specified in the security default configuration file,
Assigns a role to another different role.
The role being assigned to the other different role is referred to as a A subrole is any valid role defined in the database.
The option allows hierarchical role definition (one role can inherit other subrole). After assigning a subrole to another role,
that role will also have all the authorizations of the subrole, and any of its subroles. More than one subrole can be assigned to
other different role. verifies the role and subrole exist in It also verifies that there is no recursive definitions of the role
and subrole. (If "role1" has a subrole of "role2", and if you try to "role1" to "role2", this will cause a recursive definition of
both "role1" and "role2"). appends the subrole to the role to authorization mapping in
Revokes an authorization from the specified role in If no authorization is specified, revokes all the authorizations for the given
role. If object is not specified, then a default object will be assumed. The default object will either be a wild card (*) or the
object specified in the security default configuration file,
The file will be modified by the command.
Revokes a subrole from the specified role in Note that the role specified as the subrole is not revoked from the database, just the
subrole assignment is revoked.
For instance, if these entries are in the database:
will modify the line to:
revokes specified the authorizations and/or subrole for the given role.
Note: The file will be modified by the command.
Invoking the list command without any parameters lists every entry in Specifying a role name lists all the authorizations and sub-
roles assigned to that role name. Specifying an operation name lists all the roles witch have that operation name. Specifying a
subrole name lists all the roles which have that subrole name. Specifying lists all the authorizations in the database.
Authorizations
In order to invoke the user must either be root, (running with effective uid of 0), or have the appropriate authorization(s). The follow-
ing is a list of the required authorizations for running with particular options:
Allows user to run
with option.
Allows user to run
option.
Allows user to run
with or option.
Allows user to run
with or option.
Allows user to run
with option.
EXTERNAL INFLUENCES
Environment Variables
determines the language in which messages are displayed.
International Code Set Support
Single-byte character code set is supported.
RETURN VALUE
Success.
If is successful, it returns
Failure.
returns and prints an appropriate error message to stderr.
EXAMPLES
The following commands each add an authorization (operation, object) entry in the database file:
The following commands each delete an authorization (operation, object) entry from the database file:
The following commands each assign an authorization (operation, object) pair to a role in database file:
The following commands each assign a subrole to a role in database file:
The following commands each revokes an operation for the specified operation from a role in the file:
The following commands each revokes a subrole from the specified role in the database file:
The following command lists all the authorizations for the role:
The following command lists all the entries with operation
The following command lists all the entries with object
The following command lists all the roles with their authorizations in database:
FILES
Database containing valid definitions of all roles.
Database containing definitions of all valid authorizations.
Database specifying the roles allowed for each specified user.
Database defining the authorizations for each specified role.
SEE ALSO
cmdprivadm(1M), privrun(1M), rbacdbchk(1M), roleadm(1M), rbac(5).
authadm(1M)