vPar security

[rocke robertson]

What's stopping me from being a nasty beligerent boy with a root shell and doing a:

# vparreset -p whomever -t

RBAC certainly won't, at least I can't see how. THere's some monitor level stuff that restrics which vPars can do administrative work. But I still seem to be able as root to reset other vPars from the same nPar.

Have I missed something?

[Torsten. · Accepted solution]

Yes, you missed something.

See the manual on how to configure this security.

[Steven E. Protter]

Shalom,

Two things to do. Insure vpar security itself is as strong as a standalone system.

Make sure the console that controls the vpar is secure. Use ssh not telnet for access. Limit who has the password.

If you have root access there is no such thing as a safe system.

SEP

[Torsten.]

http://docs.hp.com/en/T1335-90083/ch11s02.html?btnPrev=%AB%A0prev

[Torsten.]

Chapter 11 vPars Flexible Administrative Capability (vPars A.03.03, A.03.04, vPars A.04.02, A.04.03, A.05.01)

...
This chapter discusses the concepts and tasks on using the vPars Flexible Administrative Capability feature (formerly called Primary-Admin vPars Security). With this feature, you can specify vPars administration capabilities for zero, one, or more designated virtual partitions. Only superusers within the designated virtual partitions can perform the vPars administration commands that affect other virtual partitions; a superuser within a non-designated virtual partition can perform only operations that affect itself.
...

http://docs.hp.com/en/T1335-90083/ch11.html

[rocke robertson]

Gentlemen, I have enabled the flexible administrative section and as you have stated, it prevents administrators from administrating other vPars.

Thank you very much for your quick responses.

If I could give you 11 points I would. A little plug for "Spinal Tap".