Access to files.

[Vicente Sanchez_3]

Hello all,

This is the situation:

I'm migrating from a HP3000 to a HP9000. In HP3000 I have several programs that need a lockword to be executed. Users from all system can access this programs, but only who knows the lockword can run them.

I'm looking for some similar situation on HP-UX.

Do you know anything about this?.

Regards, Vicente.

[Jean-Louis Phelix]

Hi,

A - Perhaps look to ACLs (man 5 acl)

B - create a dedicated login for the owner of this file and deny all access for group and other. Su'ing to this user will require a password.

C - same id without password using a dedicated secondary group for allowed people only and the newgrp command

Regards.

[Jorge Pons]

Hi Vin

Have you considered the posibility to change the permisions? put the users who can run it in the same group...

Regards

Jorge

[Vicente Sanchez_3]

Hi,

The problem is that this situation is dinamic, I mean, today ten users, from different groups, can access to Prg1, tomorrow 8 users from different groups can access to Prg1, and so.

And the number of programs with this situation can be different, also.

That's why in HP3000 I stablish a lockword to be run.

A comercial solution can be accepted.

Regards, Vicente.

[Paula J Frazer-Campbell]

Hi

How about creating a "Lockword" login and give this login and only this permission to run the prog.


Paula

[Anthony Giedlinski]

Vincente --

We have a similar problem, but changes happen more slowly. What we use is sudo. By setting up a group whose members are only the people who need to run the application, and using sudo to control access, we can lock out everyone, and manage the members of the group in a very simple fashion.

If you are not familiar with sudo, the process is like this:

install sudo.
create a group to use, such as lockword, and populate it with the people to whom you wish to grant access.

Using the visudo command (installed above), grant the members of lockword the ability to run a script that will run the application, or the application itself.

the line in the sudoers file will look something like this:

Cmnd_Alias LOCKWORD=/opt/sudo/sudo/lockword.sh

or this

Cmnd_Alias LOCKAPP=/usr/bin/lockapp

A large number of such aliases are allowed. After the aliases section, the groups or individuals and which aliases are allow are placed:

%sd-sradm ALL=(root) ALL

(this line means that members of the group sd-sradm can use sudo to gain access to run a shell as root without knowing the root password, just their own password, and also have permission to run any other aliased command above.)

%lockword ALL=(root) LOCKWORD LOCKAPP

(This line means that anyone who belongs to the group pgp, has permission to run the script defined above as Cmnd_Alias LOCKWORD, or the application /usr/bin/lockapp, and anything that the script calls, including su - lockapp, after authenticating with their own login password)

The scripts are kept in a secure (no write access, owned by root, the directory /opt/sudo is not readable by anyone, etc)

The lockapp program should be made executable only by root, or the lockapp owner.

So at this point, just by managing the members of group lockword, it is decided who can run the lockapp program.

If I understand your situation correctly, the persons who are granted access changes daily. There is one more thing that would be good to do to lock out yesterday's people: set a time when all sudo logins to lockword are terminated, which would occur after you remove those who should no longer be allowed access, and write a script to do that. The active sessions are easy to grep for with ps -ef, and could even be done periodically via cron.

One other benefit is that you don't have to keep coming up with new lockwords.

Good luck.

Tony G.

[Anthony Giedlinski · Accepted solution]

Vincente --

I corrected an error in the previous message.

We have a similar problem, but changes happen more slowly. What we use is sudo. By setting up a group whose members are only the people who need to run the application, and using sudo to control access, we can lock out everyone, and manage the members of the group in a very simple fashion.

If you are not familiar with sudo, the process is like this:

install sudo.
create a group to use, such as lockword, and populate it with the people to whom you wish to grant access.

Using the visudo command (installed above), grant the members of lockword the ability to run a script that will run the application, or the application itself.

the line in the sudoers file will look something like this:

Cmnd_Alias LOCKWORD=/opt/sudo/sudo/lockword.sh

or this

Cmnd_Alias LOCKAPP=/usr/bin/lockapp

A large number of such aliases are allowed. After the aliases section, the groups or individuals and which aliases are allow are placed:

%sd-sradm ALL=(root) ALL

(this line means that members of the group sd-sradm can use sudo to gain access to run a shell as root without knowing the root password, just their own password, and also have permission to run any other aliased command above.)

%lockword ALL=(root) LOCKWORD LOCKAPP

(This line means that anyone who belongs to the group lockword, has permission to run the script defined above as Cmnd_Alias LOCKWORD, or the application /usr/bin/lockapp, and anything that the script calls, including su - lockapp, after authenticating with their own login password)

The scripts are kept in a secure (no write access, owned by root, the directory /opt/sudo is not readable by anyone, etc)

The lockapp program should be made executable only by root, or the lockapp owner.

So at this point, just by managing the members of group lockword, it is decided who can run the lockapp program.

If I understand your situation correctly, the persons who are granted access changes daily. There is one more thing that would be good to do to lock out yesterday's people: set a time when all sudo logins to lockword are terminated, which would occur after you remove those who should no longer be allowed access, and write a script to do that. The active sessions are easy to grep for with ps -ef, and could even be done periodically via cron.

One other benefit is that you don't have to keep coming up with new lockwords.

Good luck.

Tony G.

[Caesar_3]

Hello!

Try to devide the users to groups and only
the group that should run this program could
run it or you can start to use sudo program
where you could made rulls who can run the program.

Caesar

[Jorge Pons]

Hi Vin

Another thing you can do is rename the original program, and create a file with the old name of the program, where validate a specific word as a password, and if the word is correct, called the program (new name).

Regards, Jorge