10 More Discussions You Might Find Interesting
1. Linux
When unlocking a Linux server's console there's no event indicating successful logging
Is there a way I can fix this ?
I have the following in my rsyslog.conf
auth.info /var/log/secure
authpriv.info /var/log/secure (1 Reply)
Discussion started by: walterthered
1 Replies
2. AIX
Hi all,
i have a little problem...
I have a Trusted AIX v. 6.1 installed on my system p.
I can't disable RBAC mode...
$ lsattr -El sys0 -a enhanced_RBAC
enhanced_RBAC true Enhanced RBAC Mode True
$ chdev -l sys0 -a enhanced_RBAC=false
Method error (/usr/lib/methods/chggen):
0514-018... (3 Replies)
Discussion started by: Zio Bill
3 Replies
3. Solaris
I'm trying to set up RBAC, and I need to know where the logs for RBAC are.
I'm using Solaris 10 as my OS.
I've been reading a lot of documents online and just can't seem to find where the related logs are.
My problem is I need to be able to track a user when they su to a role profile, and... (2 Replies)
Discussion started by: bitlord
2 Replies
4. HP-UX
hi every one i tried rbac and i made
1- role called GizaRoot
2- group called gizagroup
3- added privlage autherization called "m.k"
/usr/sbin/useradd:dflt:(m.k,*):0/0//:dflt:dflt:dflt:
i assigned the role to group and add user to that group then su to user and tried to use the command ... (0 Replies)
Discussion started by: maxim42
0 Replies
5. Solaris
Hi all!
On backup server with contab my script worked, but one command don't fine to be executed:
bash-3.00$ scp itadmin@172.17.0.44:/export/backups/* /bckp1/opencms/bcp_`date +%Y%m%d`/
www-zone.cfg 100%... (0 Replies)
Discussion started by: sotich82
0 Replies
6. UNIX for Dummies Questions & Answers
Can anyone help me on "How to change Unix to support RBAC policy"? (4 Replies)
Discussion started by: JPoroo
4 Replies
7. AIX
I would like to use the Role Based access control to granulize some of the administration of AIX systems in our organization. Across the company we will be using aix 5.3. One of these roles will only have the access to make, change and delete users, something similar to ManageAllUsers. The thing... (1 Reply)
Discussion started by: dgaixsysadm
1 Replies
8. Shell Programming and Scripting
what would be easier to automate a script if/then ? (0 Replies)
Discussion started by: deaconf19
0 Replies
9. Solaris
do i have to create a new account to add a role?
i want the sysadmin login
i have 3 users on my systems
sysadmin
secman
oc01
also 3 profiles
SA (goes t0 sysadmin account)
SSO (goes to secman account)
LMICS (goes to oc01 account)
the user accounts are located in /h/USERS/local
the... (4 Replies)
Discussion started by: deaconf19
4 Replies
10. Solaris
I am trying to let user asillitoe su to the godbrook role to execute commands. I have editted files as follows:
user_attr:
asillito::::type=normal;roles=godbrook
godbrook::::type=role;profiles=Gadbrook,All
prof_attr:
Gadbrook:::Allow root commands to be used by godbrook:
exec_attr:... (0 Replies)
Discussion started by: chrisdberry
0 Replies
roleadm(1M) roleadm(1M)
NAME
roleadm - noninteractive editing of role-related information in RBAC databases
SYNOPSIS
[comments]
[role]
DESCRIPTION
is a noninteractive command that allows users with the appropriate authorization to modify and list the role information in and
See rbac(5) for information on these RBAC databases.
HP recommends that only the and commands be used to edit and view the RBAC databases. Do not edit the RBAC files directly.
Options
recognizes the following options:
Add a role to the system list of valid roles.
Appends a line in file with rolename. You can enter an optional comment after the role.
Remove a role from the system list of valid roles.
If role is present in remove entry. If role is not present, then returns an error code; see
Change the name of a role.
This option causes a modification of the RBAC databases and replacing each occurrence of oldrolename with newrolename.
Assign a role to a user or a group.
First verifies that the user is a valid user, and the role is present in the file. When this is the case, the role is appended to
the user->role mapping in the file. If user argument has an ampersand at the beginning (such as &users), then it is assumed that
what follows after the ampersand is a group name - the ampersand must be shell escaped or put in quotes such as users or "&users".
An administrator may specify a default set of roles by assigning roles to the keyword. If a user is not otherwise explicitly
assigned roles in the database, he or she will be given roles assigned to the role.
Revoke a role from the specified user.
If no role is specified, then all roles are revoked for the given user. (The user entry is removed from If user argument has an
ampersand at the beginning (such as &users), then it is assumed that what follows after the ampersand is a group name - the amper-
sand must be shell escaped or put in quotes such as users or "&users".
List user and role information from the RBAC databases, and
If neither nor are specified, then list all the users with assigned roles.
If is specified, then only the role(s) of the specified user will be listed. If user has an ampersand at the beginning (such as
&users), then it is assumed that what follows after the ampersand is a group name - the ampersand must be shell escaped or put in
quotes such as users or "&users". If only is specified, then only list the user(s) assigned to the specified role. If both and are
specified, then the entry with the user username and role rolename will be listed, if it exists.
If the specified user does not exist in the system and there exists the special user, in the database, then the roles listed for the
specified user will be those of the user. In the event that there is more than one user defined in the database, the system will
recognize only the last one.
If is specified, then all the roles in the roles database, will be listed. When is specified, no other argument will be taken by
Authorizations
In order to invoke the user must either be root, (running with effective uid of 0), or have the appropriate authorization(s). The follow-
ing is a list of the required authorizations for running with particular options:
hpux.security.access.role.add,*
Allows user to run roleadm with "add" option.
hpux.security.access.role.delete,*
Allows user to run roleadm with "delete" option.
hpux.security.access.role.modify,*
Allows user to run roleadm with "modify" option.
hpux.security.access.role.assign,*
Allows user to run roleadm with "assign" option.
hpux.security.access.role.revoke,*
Allows user to run roleadm with "revoke" option.
hpux.security.access.role.list,*
Allows user to run roleadm with "list" option.
EXTERNAL INFLUENCES
Environment Variables
determines the language in which messages are displayed.
International Code Set Support
Single-byte character code set is supported.
RETURN VALUE
Upon completion, returns one of the following values:
Success.
Failure.
An appropiate error message is printed to stderr.
EXAMPLES
The following command will append the line to file.
The following command will append the line to the file.
The following command will delete line in file and other databases.
The following command will delete line from the file.
The following command will replace role name with in and
The following command will append line
to file:
The following command will remove the line from file:
The following command will remove all the roles for user from file:
The following command will remove all the roles for group name from file:
The following command will list all the roles for user
The following command will list all users and groups with role
The following command will list entries with user and rolename
The following command will list entries with group name
The following command will list all the entries in
FILES
Database containing valid definitions of all roles.
Database containing definitions of all valid authorizations.
Database specifying the roles allowed for each specified user.
Database that defines the allowed authorization for each specified role.
Database containing the authorization to execute specified commands
and the privileges to alter uid and gid for command execution.
SEE ALSO
authadm(1M), cmdprivadm(1M), privrun(1M), rbacdbchk(1M), rbac(5).
roleadm(1M)