topic Re: Non-Root/Role Based Admin in Operating System - HP-UX

Non-Root/Role Based Admin

Scot Sroka — Thu, 13 Mar 2003 14:33:37 GMT

Hello.

Other than SCM, sudo, runas, uid=0, and restricted sam, what software and/or methods exist to allow non-root/role based administration?

In your opinion, what is the best option (including the above)?

Thanks for your help.

Re: Non-Root/Role Based Admin

Pete Randall — Thu, 13 Mar 2003 14:37:23 GMT

You've pretty well covered the options that I'm aware of. The best option really depends on the circumstances and what you're trying to accomplish. I would guess that a combination of sudo and restricted SAM should pretty much cover anything, but SCM could be helpful, too.

Pete

Re: Non-Root/Role Based Admin

Patrick Wallek — Thu, 13 Mar 2003 14:56:39 GMT

I agree with Pete in that you've covered the options available pretty well.

I like sudo and restricted sam where applicable as well.

Re: Non-Root/Role Based Admin

Ravi_8 — Thu, 13 Mar 2003 15:10:43 GMT

Hi,

You have covered all available methods.

In my opinion sudo is the best option to provide non root based admin

Re: Non-Root/Role Based Admin

John Payne_2 — Thu, 13 Mar 2003 15:24:44 GMT

The only thing you did not list was CA's eTrust products. (admin/access control) They are not cheap. The role based stuff is pretty much like sudo, repackaged and pretty. (It is good for if you have alot of servers with alot of users to manage, though.)

If you only have a few servers or aren't trying to manage permissions for 200+ users with 10+ different permission levels, use sudo. Otherwise, that's all you will do for months until everyone's happy. (I would definitely use sudo if you are only talking about a few different groups with relatively few special permissions.) Make sure you do not allow 'su su root' in your sudo, so you don't defeat your point...

Hope it helps.

John

Re: Non-Root/Role Based Admin

Rita C Workman — Thu, 13 Mar 2003 15:26:01 GMT

I use restricted SAM...and PowerBroker (third party vendor).

Rgrds,
Rita