security file

[fergani]

Hi everyone;
I am using tru64 unix v5.1 and I am a junior DBA.
I created a batch file inside the root directory , so I want certain users to have privileges to execute it only,but not to open it.

Do you think should I put this file inside root directory or inside the users directory who have the privileges to execute it only,but not to open it.

bye.

[Martin Moore]

Access control lists might be the best solution for you. Do "man acl" for an introduction.

Martin

[Pieter 't Hart]

I would suggest to keep the root directory clean.
Normally I would put own jobs like this
- at least in a subdirectory of the root (like /DBAprod)
- or even on a separate filesystem
- in your own home directory
- in a central DBAuser home directory

[fergani]

Hi
I read the help of acl but there are many things I couldn't understand.
please could you provide my an example shown me How to get certain users to have privileges to execute a batch file only,but not to open it.

bye.

[Pieter 't Hart]

Instead of specifying each user in an acl it's more flexible to create two extra groups in /etc/group using "sysman groups".
eg. DBAexecute and DBAread (maybe also DBAowner)
add all appropriate users to the corresponding group.
set acl on the file with permissions.
"setacl -D -u group:DBAread:r--,group:DBAexecute:--x,group:DBAowner:rwx"

With standard unix protection you could also set the group of the file to DBAexecute
"chgrp DBAexecute" and set protection with chmod so the owner can read/write and the group execute.
"chmod u=rwx,g=x,o=" (o= now owner but other!)

[fergani]

hi everyone
I need someone to explain me this statement:-
setacl -u group::r--,user:alpha:-w- shared

shared is the file.
I found it in the help but I don't understand.
bye

[Martin Moore]

It gives read access to the group that owns the file (which could be done with the regular file permissions just as well) and it gives write access to the file to user "alpha".

Martin

[Martin Moore]

A further thought: have you checked out the information on ACL's in the security manual? The V5.1B manual is at http://www.tru64unix.compaq.com/docs/base_doc/DOCUMENTATION/V51B_HTML/ARH95ETE/TITLE.HTM and has a very nice writeup, IMO, on ACL's. See Chapter 2, especially section 2.3.

Martin