topic Re: vPar security in Operating System - HP-UX

vPar security

rocke robertson — Thu, 28 Aug 2008 14:00:45 GMT

What's stopping me from being a nasty beligerent boy with a root shell and doing a:

# vparreset -p whomever -t

RBAC certainly won't, at least I can't see how. THere's some monitor level stuff that restrics which vPars can do administrative work. But I still seem to be able as root to reset other vPars from the same nPar.

Have I missed something?

Re: vPar security

Torsten. — Thu, 28 Aug 2008 14:05:50 GMT

Yes, you missed something.

See the manual on how to configure this security.

Re: vPar security

Steven E. Protter — Thu, 28 Aug 2008 14:06:45 GMT

Shalom,

Two things to do. Insure vpar security itself is as strong as a standalone system.

Make sure the console that controls the vpar is secure. Use ssh not telnet for access. Limit who has the password.

If you have root access there is no such thing as a safe system.

SEP

Re: vPar security

Torsten. — Thu, 28 Aug 2008 14:08:01 GMT

http://docs.hp.com/en/T1335-90083/ch11s02.html?btnPrev=%AB%A0prev

Re: vPar security

Torsten. — Thu, 28 Aug 2008 14:09:28 GMT

Chapter 11 vPars Flexible Administrative Capability (vPars A.03.03, A.03.04, vPars A.04.02, A.04.03, A.05.01)

...
This chapter discusses the concepts and tasks on using the vPars Flexible Administrative Capability feature (formerly called Primary-Admin vPars Security). With this feature, you can specify vPars administration capabilities for zero, one, or more designated virtual partitions. Only superusers within the designated virtual partitions can perform the vPars administration commands that affect other virtual partitions; a superuser within a non-designated virtual partition can perform only operations that affect itself.
...

http://docs.hp.com/en/T1335-90083/ch11.html

Re: vPar security

rocke robertson — Thu, 28 Aug 2008 14:39:41 GMT

Gentlemen, I have enabled the flexible administrative section and as you have stated, it prevents administrators from administrating other vPars.

Thank you very much for your quick responses.

If I could give you 11 points I would. A little plug for "Spinal Tap".