topic Re: Permissions under /tcb/files/auth in Operating System - HP-UX

Permissions under /tcb/files/auth

Zigor Buruaga — Thu, 30 Sep 2004 13:02:13 GMT

Hi experts,

OS: Hp-UX 11.00 & 11.11

Following the HPUXBenchmark security policies, I have changed the permissions under "/tcb/files/auth/" to 700. However, each time a user log on ( i.e. "user1", its security file has again the old permissions 644, "/tcb/files/auth/u/user1" ).
I'm sure that I'm missing something here, any help would be highly appreciated.

Thanks in advance.
Best regards,
Zigor

Re: Permissions under /tcb/files/auth

Zigor Buruaga — Thu, 30 Sep 2004 13:08:35 GMT

Hi again,

Little mistake, the user security file has again the old permissions 664, not 644.

Thanks!
Best regards,
Zigor

Re: Permissions under /tcb/files/auth

Prashant Zanwar_4 — Thu, 30 Sep 2004 13:46:33 GMT

Even I have the following in my setup. I believe

# ls -ld $PWD
drwxrwx--x 55 root sys 1024 Mar 19 2004 /tcb/files/auth

/tcb/files/auth/pzanwar not found
# ls -ld $PWD/p/pzanwar
-rw-rw-r-- 1 root root 211 Sep 30 13:44 /tcb/files/auth/p/pzanwar

# ls -ld /tcb
dr-xr-x--x 3 root sys 96 Mar 19 2004 /tcb

I believe at the tcb level it is taken care. Hope this helps
Prashant

Re: Permissions under /tcb/files/auth

Patrick Wallek — Thu, 30 Sep 2004 16:39:14 GMT

No way to get around that, that I know of. I look at the HPUX Benchmark stuff at one point and was not terribly impressed. They recommended setting permissions on lots of files the either 1) don't work (like /tcb), or 2) just flat don't make sense.

Re: Permissions under /tcb/files/auth

Victor BERRIDGE — Thu, 30 Sep 2004 17:08:02 GMT

I agree with Patrick,
2) e.g. what is the point for posssible security breach to change /usr/sbin/swapinfo permissions if you can cp /usr/sbin/swapinfo to you home directory and execute it?

All teh best
Victor

Re: Permissions under /tcb/files/auth

Zigor Buruaga — Thu, 30 Sep 2004 23:02:25 GMT

Hi again,

OK, "strange" recommendations then ...
Thanks for all the answers.

Best regards,
Zigor

Re: Permissions under /tcb/files/auth

Chris Calabrese — Mon, 04 Oct 2004 14:03:44 GMT

It definitely does not make sense to chmod files in /tcb/files/auth when the system keeps changing them back.

And that's why we've eliminated in the upcoming revision of the CIS HP-UX benchmark.

This is just one of many changes due to feedback from the community.

There are also some other changes to reflect feature-changes in the latest HP-UX releases and in add-on the packages for HP-UX (like HP's new Security Patch Check version).

We're just finishing up work on the new version, but it's never too late to send your feedback/wishlist to me at chris_calabrese@yahoo.com.

As for /usr/bin/swapinfo, I'm having a hard time finding reference to that file in any of the HP-UX Benchmark versions that CIS has published. Victor, can you provide me with additional details?

Thanks.

--
Chris Calabrese
Center for Internet Security
HP-UX Benchmark Editor
chris_calabrese@yahoo.com

Re: Permissions under /tcb/files/auth

Zigor Buruaga — Tue, 05 Oct 2004 13:23:14 GMT

Hi,

Thanks for your answer Chris.
I will let this thread open, so who wants can give you more feedback about this matter also in this site. The experts are here.

Thanks again to all.
Best regards,
Zigor

Re: Permissions under /tcb/files/auth

Herman Chim_2 — Mon, 15 Oct 2007 12:12:50 GMT

Hi,

In HP-UX 11.23 & 11.31, system still changes the permission back to 664. Our auditor wants to confirm if the settings is appropriate. Is there a way to avoid the permission change?

Thanks,
Herman