user permission to be restricted

[Abdul Salam H S_1]

Hi,

I have a user(x), belonging to group(y).For security reasons,I don't want this user to have the full rights, which he gets by default, being in that particular group.For this user, I need to set write permissions for one particular directory and read permission for another directory.Is it possible to do this and how? Can we use ACL for doing this.Is ACL supported with vxfs? Since all the Filesystems I have are vxfs.

Thanks and regds,

Abdul Salam

[S.K. Chan]

ACL is supported for JFS3.3 and above. You can use the command "setacl" and "getacl". For more details ..

# man setacl
# man getacl

[S.K. Chan]

The online doc you need ..

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B3929-90011/B3929-90011_top.html&con=/hpux/onlinedocs/B3929-90011/00/00/24-con.html&toc=/hpux/onlinedocs/B3929-90011/00/00/24-toc.html&searchterms=JFS%7cAccess%7cControl%7cLists&queryid=20020422-103156

[Helen French · Accepted solution]

Hi Abdul =))

Yes you can use ACLs for doing this task. You need to have JFS version 3.3 for this. ACL is not supported on version 3.0. You can use getacl and setacl commands. See the man pages.

Also this site will give you all details about ACLs with JFS:

http://www.docs.hp.com/hpux/onlinedocs/os/jfs_acl.pdf

HTH,
Shiju

how's life there ?

[Hai Nguyen_1]

ACL is supported only by hfs filesystems.

Try SAM to restrict the user's rights.

Hai

[Deshpande Prashant]

HI
I would suggest to create that user (x) in all together different group (z) and then use ACLs to allow him to write into dir.s required.

Thanks.
Prashant.

[Abdul Salam H S_1]

Hi friends,

Thank you all for your valuable advices.
I haven't tried it.Once I try it, I'll assign the points.

Thanks and Regds,

Abdul Salam

[Abdul Salam H S_1]

Hi,

I have one more doubt! Is it possible to convert the vxfs filesystem (JFS ver 3.0), which I already have to JFS 3.3 online ie, without doing newfs on it, so that I won't lose the data in it? I heard something like vxupgrade command.Does it solve my requirement?

Also, the JFS 3.3 which I downloaded from the hp site didn't get installed. Although, swlist -d shows both the bundles ,JFS foundation and JFS 3.3 ,it gave error during analysis phase and came out.Has anyone tried this? What could be wrong?


Thanks and Regds,

Abdul Salam

[Helen French]

Abdul daa =))

You are right. The command is vxupgrade. This is the normal procedure:

1) Install JFS 3.3 from the application CD
2) Use the vxupgrade(1M) command to convert the filesystem from version 3 to 4 disk layout.
3) If you create new filesystems, then specify the version option -4 with mksf command.

Check and make sure that you have all the latest patches in the system before you do this. Also check the man pages and see about the file system space requirement before you convert it. vxupgrade requires free space in the file system to perform the upgrade.

See this admin guide too:

http://www.docs.hp.com/hpux/onlinedocs/B3929-90011/B3929-90011.html

HTH,
Shiju

[Helen French]

Abdul:

One more thing - you should not try to upgrade the /, /usr, /var, /opt etc. It is not supported and will give you problems while system boots. Once you upgrade, it cannot be downgraded ! Also once upgraded to version 4 file systems, it will be mountable only on:

1)HP-UX 11.0 with JFS3.3 from application CD
2) HP-UX 11.1X and above

HTH,
Shiju

[Wodisch]

Hi,

since you would have to set a LOT of ACLs, how about configuring that user to
- run in a "chroot" environment
- use a "restricted" shell
- makeing only restricted versions of the neccessary programs available

But simply the best would be to NOT give them any shell at all!

Just my $0.02,
Wodisch

[Deshpande Prashant]

HI
Install the JFS product from application CD.
#swinstall -x ask=true -x autoreboot=true -S/SD_CDROM JFS

Before install the necessary patches (at least the QPAK)
After rebooting machine you will have to install licnse key and enable online JFS-

#/sbin/vxlicense -c
#/sbin/fs/vxfs3.3/vxenablef -a (to enable online JFS)

Once done, you can upgrade all Non VG00 volumengroups to version 4 layout with
#/sbin/fs/vxfs3.3/vxupgrade -n 4
command.

Thanks.
Prashant Deshpande.