topic Thrusted System in Operating System - HP-UX

Thrusted System

Marcel Garcia Will — Fri, 04 Jul 2003 17:16:29 GMT

If I enable the login time an user, Can I make su to this user from other user? If I can, how I configure it?

Thanks

Re: Thrusted System

Steven E. Protter — Fri, 04 Jul 2003 18:49:31 GMT

The answer to your question is yes.

su - username will give you the user along with the environment. Take out the dash and you only get priviledges.

Trusted System is done either by running Bastille Security Checker or by Going into sam Security(obvious from there) as root user.

The only configuration after that is to make the audit logs manageable. Too much logging and you just fill up filesystems.

SEP

Re: Thrusted System

Marcel Garcia Will — Fri, 04 Jul 2003 19:05:57 GMT

thanks SEP, but it cannot resolve my problems.
I??ve added a login time policy to an user.
If I want to make su - [user] from other user besides root, the su - [user] fails. su - [user] obey login time policy, like telnet?

in time, I need to make su - [user].

Re: Thrusted System

Steven E. Protter — Fri, 04 Jul 2003 20:06:23 GMT

Greetings,

I do not fully understand your problem.

Here is what I understand.

You limit logins based on time.

Do you want to enable or disable su - logins.

What is the error message you receive.

Detail will help me understand.

SEP

Re: Thrusted System

Michael Tully — Fri, 04 Jul 2003 23:04:56 GMT

This is not the way this should work.

The security policy can only be enforced if:
The user logs in
If you su - xxxx you are changing the rules.
Each su session is recorded in syslog/sulog.

Why do you wish to su anyway? Why can't the user use his/her own login ? There are ways that file permissions can be manipulated with groups and acls.

Within the shell there is an idle timeout facility (TMOUT and autologout depending on the shell type)

I am sure that you compile or change options with using the 'sudo' product where there is a timeout.

Re: Thrusted System

Wouter Jagers — Sat, 05 Jul 2003 14:34:45 GMT

I think Marcel wants to know whether it is possible to switch to a time-restricted account while outside of the 'allowed logon hours' of the target account.

I guess not, since I assume this policy is checked at -every- logon, including su's.. hence, as a non-root user I don't think it will work.

Best regards