There are several aspects to account administration:
The
Account Manager interface
provides a convenient, interactive way to perform most
account administration tasks.
The Account Manager interface
The Account Manager allows you to create or modify user accounts.
You can start the Account Manager in any of these ways:
The main display of the Account Manager includes a list of accounts on the system. The icons (or characters) in the ``Status'' column indicate the type of account and its status. By default, the Status information is not displayed to keep startup time to a minimum. To display status information, select Show Status from the Options menu.
You can display a list of groups on the system by selecting Groups from the View menu.
Figure 1-1 Account Manager status icons
Authorization
When run from an account other than root,
use of the Account Manager requires the auth
authorization. See
``Assigning subsystem authorizations''
for more information.
About default selections
Many selections of the Account Manager
have multiple choices:
Yes and No (or a single numerical value),
and Default. When you
choose the Default option, you are not simply using
a static value that is copied into the user's account. Instead,
you are configuring the account to use a default value that
can change dynamically. That is, you can change the
system default value that immediately affects all accounts.
With this in mind, you can configure user accounts to use
either a specific static value, or a dynamic one associated
with most users.
Adding and modifying user accounts
In the
Account Manager,
select Add New User
from the Users menu, or select a user from
the list and select
Modify from the Users menu.
When adding a new user, you need only enter a name and assign a password. If you select Set password later, the user will not be able to log in until you assign one as described in ``Setting or changing a user password''.
You can alter any of these attributes (system defaults are used if you do not):
To change the system default values, select User Defaults from the Options menu.
You can also create users on the command line:
useradd username
Default values are used unless overridden by command line options described in the useradd(ADM) manual page.
See also:
Here is an example template, template1, that specifies several attributes, including group membership, kernel privileges, login restrictions, password restrictions, and authorizations:
{ groups { gedemondan czillian dillian type41 oolakash } }
{ kernelAuths { chown execsuid su } }
{ maxLoginAttempts 8 }
{ passwdExpirationTime 60 }
{ passwdLifetime 120 }
{ passwdRunGenerator 1 }
{ subsystemAuths { printerstat printqueue queryspace } }
Templates can be used to create new accounts,
modify existing accounts, or change the system defaults.
Here is an example that creates a new account for user
mavrac that uses template1:
useradd -X template1 mavrac
The new account will use all the default account values except for those listed in the template file. To modify an existing account for the same user, you would simply substitute usermod for useradd.
You can also modify account defaults using a template file.
Assuming you wanted to replace the current
system defaults with the values in template1,
you would use this command:
usermod -D -X template1
You can use the userls command to list account attributes
that you can in turn use to create a template. For example, this
command directs the attributes for user mavrac into a
file:
userls -l mavrac -A > template1
You must edit the output from userls because it contains all attributes, including status information that cannot be changed (such as last login time), but you can us it as a basis for a template file.
See also:
Removing or retiring a user account does not remove the user's files; the system administrator must do this manually by deleting the directory. In addition, there may be other files that belong to the user. See ``Changing ownership of files with an obsolete UID/GID'' for more information.
See also:
The user should then be able to log in to the account.
Setting and changing user and group IDs (UID/GID)
Each user and group is assigned an identification number (UID
or GID). This ID number is stamped on all files,
directories, and processes on local and NFS-mounted filesystems.
When you create a new user or group, a new UID or
GID number is
automatically assigned, but you can specify another
by entering it in the text field.
To change the ID number for an existing user or group, use the usermod(ADM) or groupmod(ADM) command. Changing an ID number of a user or group does not change the ID on files owned by the user or group; the system administrator must do this manually as described in ``Changing ownership of files with an obsolete UID/GID''.
To alter the range of UIDs from which you select for new users, select User Defaults from the Options menu. To alter the range of GIDs from which you select for new groups, Group Defaults from the Options menu.
See also:
-rw-r--r-- 1 obie pub 68476 Nov 16 12:06 accts.s -rw-r--r-- 1 15625 pub 508 Oct 31 11:15 balance -rw-r--r-- 1 obie pub 40596 Aug 31 13:19 report.2In this example, the file balance is an orphaned file. The number appears because files are stamped with the ID number rather than the user or group name.
Use the
find(C)
utility to locate and change the ownership of files.
This command line finds all files on the system owned by user
UID and changes ownership to user newowner:
find / -user UID -print | xargs -t chown newowner
This variation changes the group ownership:
find / -user GID -print | xargs -t chgrp newgroup
Instead of changing the ownership, you can perform other actions, such as archiving the files; see ``Locating files''.
See also:
The login group is the default group to which the user belongs. Files and directories created by the user are owned by this group. Users can temporarily change their login group using the sg(C) command.
To change the system default login group, select User Defaults from the Options menu.
See also:
To add user to a group, select an entry in the ``Other Groups'' column and click on the Add button.
To remove a user from a group, select an entry in the ``Member of'' column and click on the Remove button.
You can search for a specified group by entering the name in the ``Search for:'' field.
To change the set of default groups assigned to new users, select User Defaults from the Options menu.
See also:
To change the system default login shell, select User Defaults from the Options menu.
Each shell has one or more environment files specific to that shell (for example, .profile and .kshrc for ksh(C)). To add environment files to the home directory, select Add Shell Environment Files to Home Directory. (This button has no effect on a newly created home directory; environment files are always added in this case.)
See also:
See also:
Restricted shells
There are restricted versions of the Bourne and Korn shells
(rsh and rksh) that prohibit changing
directory with cd, setting the value of $PATH,
using command names containing slashes, and redirecting
output using > and >>.
Changing user home directories
In the
Account Manager,
select the user name,
then select Modify from the Users menu.
Use the Change Home Directory button to display
the home directory options (only the first three are available when
you add a new user):
To change the system default location, select User Defaults from the Options menu.
Changing user type
Optional user type labels are provided for sites wishing to
distinguish between different types of users.
To change the type for an account, use this command line:
usermod -x "{userType type}" user
where user s the name of the account and
type is one of:
root
operator
sso
admin
pseudo
general
retired
To change the system default used for account creation, use this command line:
usermod -D -x "{userType type}"
By default user accounts have the type label of ``general'',
and you need not change it. Anonymous accounts like sysinfo
and uucp have the label ``pseudo-user''.
Each pseudo-user has an accountable user,
who is considered responsible for that account.
(For example, root, an individual, is defined as
the accountable user for all pseudo-user accounts.)
Changing user priority
The priority setting determines the scheduling priority for the user's
processes: the greater the value, the higher the priority.
To change the priority for an account, use this command line:
usermod -x "{nice value}" username
Processes using traditional scheduling have priorities 0 (low) to 127 (high); processes using real-time scheduling have priorities 128 to 255.
To change the system default used for account creation, use this command line:
usermod -D -x "{nice value}"
See also:
You can also add login shells (and configuration files) to the set of login shells available from the Account Manager. Examine the existing files and follow their example. Make sure the permissions and ownership are consistent with these files. When you install the files, the new shell is available in the Account Manager.
See also:
See also:
You can set the group of a file or directory by changing its properties from the Desktop or by using the chgrp(C) command. For more information on properties, see ``Controlling file permissions'' in Using the Desktop.
A user can be a member of several groups at once, and can access any file or directory that is within their group set (if group permissions allow). This membership set is known as the supplemental group list. By default, files created by a user have the group ID of their login group. Users can change their current working group (also known as effective group ID) or manipulate their supplemental group list with the sg(C) command.
See also:
To modify an existing group, select Group from the View menu, select a group name, then select Modify from the Groups menu.
To add user to the group, select an entry in the ``Other Users'' column and click on the Add button.
To remove a user from the group, select an entry ``Users In Group'' column and click on the Remove button. You can also search for a user name to select.
To alter the range of GIDs from which you select for new groups, select Group Defaults from the Options menu.
To create groups on the command line:
groupadd groupname
Default values are used unless overridden by command line options -- see groupadd(ADM).
See also:
Removing a group does not change the GID of files on the system. The administrator must do this manually. See ``Changing ownership of files with an obsolete UID/GID'' for more information.
See also:
To set the SGID bit on a directory, use this command,
substituting the directory name for directory:
chmod g+s directory
To remove the bit, replace the ``+'' with a ``-'' in the
chmod command.
Changing the limit on simultaneous group membership
The maximum number of groups that a user can be in at one time
is 8 by default. There are no warning messages displayed when
this number is exceeded, but when the
sg(C)
command is used to extend a user's group list using the
verbose option (-v), this error message is displayed:
sg: unable to add group group as supplemental group list fullThis limit is controlled by the NGROUPS tunable kernel parameter. To change this value, use the Hardware/Kernel Manager or the configure(ADM) command. Select category 7, ``User and group configuration'', then change the value of NGROUPS. The kernel must then be relinked and booted for the new value to take effect. See ``Relinking the kernel'' in the SCO OpenServer Handbook for more information.
These tasks are associated with passwords:
You have these options:
If you are entering a new password, type it in the ``Enter Password'' field (the password is not displayed). You are then switched to the ``Confirm Password'' field to enter it once more.
Use the Generate a password button to create a password for a user. Generated passwords are pronounceable, meaning that they are nonsense words rather than just random strings of letters (for example: juhahiwa). The password is automatically entered in the password fields; click on OK to accept the password, otherwise click on the Generate... button until a satisfactory password is generated.
Users can also generate their own passwords, unless you prevent them from running the generator. See ``Allowing users to generate passwords'' for more information.
See also:
System defaults are used unless you use the default toggle buttons to unstipple the text fields:
You can change the value for an individual user with the usermod(ADM) command by omiting the -D option and appending the user name to the above commands.
The default account initialization files (.cshrc, .profile, .kshrc, and so forth) automatically execute the prwarn(C) utility at login time to warn users about impending password expiration.
See also:
To permit a user to log in without a password, set Password Required to No. Accounts without passwords are a major security risk. To use the system default value, set it to Default.
To change the system default value, use this command line:
usermod -D -x "{passwdNullAllowed value}"
where value is either 1 (no password required) or 0 (a password is required).
You can change the value for an individual user with the usermod(ADM) command by omiting the -D option and appending the user name to the above command.
Preventing users from changing their passwords
In the
Account Manager,
select a user name, then select Password Restrictions
from the Users menu, then select Selection.
Set User can choose own to No. Users will then have to get passwords from the accounts administrator when their passwords expire, or the password generator will create them. To use the system default value, set it to Default.
To change the system default value, use this command line:
usermod -D -x "{passwdChooseOwn value}"
where value is either 1 (users can choose their own password) or 0 (a password is supplied by the administrator or the password generator).
You can change the value for an individual user with the
usermod(ADM)
command by omiting the -D option
and appending the user name to the above command.
Allowing users to generate passwords
In the
Account Manager,
select a user name, then select Password Restrictions
from the Users menu, then select Selection.
You can choose to have the system generate passwords automatically for users. This guards against users picking ``obvious'' passwords that a knowledgeable intruder could guess, given some personal facts about the user.
To permit users to generate (but not choose) a new password, set User can run generator to Yes. To use the system default value, set it to Default.
To change the system default value, use this command line:
usermod -D -x "{passwdRunGenerator value}"
where value is either 1 (the user can run the generator) or 0 (the user cannot).
You can change the value for an individual user with the
usermod(ADM)
command by omiting the -D option
and appending the user name to the above command.
Restricting password obviousness
An important part of password control is ensuring that
passwords are difficult to guess without being too
complex to remember.
You can prevent users from using
passwords that are too easy to guess, like dictionary
words or system names.
In the Account Manager, select a user name, then select Password Restrictions from the Users menu, then select Selection.
Set Check for Obviousness to Yes to run complex checks on passwords. The meaning of Yes and No varies with the security profile level chosen. To use the system default value, set it to Default. The meaning can also be set independent of the security profile as described in ``Customizing password checking''.
To change the system default value, use this command line:
usermod -D -x "{passwdCheckedForObviousness value}"
where value is either 1 (use complex checks) or 0 (use less restrictive checks).
You can change the value for an individual user with the usermod(ADM) command by omiting the -D option and appending the user name to the above command.
Table 1-1 Password checking by security profile
Security Check for Obviousness Defaults No Yes ------------------------------------------- Low - - Traditional System V System V-plus Improved/High goodpw weak goodpw strongSystem V (traditional UNIX System V checking) checks that a password:
System V-plus (System V with additions) checks that a password is:
goodpw weak checks that a password does:
goodpw strong (goodpw weak plus additional checks) checks that a password:
For information on using the command line interface, see the
usermod(ADM)
manual page.
Customizing password checking
The
goodpw(ADM)
utility also allows you to customize password
checking.
The file /etc/default/goodpw
contains the password control settings. These settings allow you to
specify if passwords are checked against dictionary words, word rotations,
and user, group, and system names.
You can also define regular expressions (character
combinations and arrangements) that all passwords must match
(or not match) with the files
/usr/lib/goodpw/match and /usr/lib/goodpw/reject,
respectively. See
goodpw(ADM)
for more information.
Setting password length
Password length is controlled by three parameters:
To reconfigure the minimum length, change the value of PASSLENGTH
in /etc/default/passwd. If PASSLENGTH is removed
from the file or is set to an asterisk (PASSLENGTH=*),
the value is calculated by the system; see
``Restricting password obviousness''
for more information.
You can configure the generated length for individual users with the Account Manager. Select a user name, then select Password Restrictions from the Users menu, then select Selection.
To change the system default value, use this command line:
usermod -D -x "{passwdGeneratedLength value}"
where value has a maximum value of 80.
You can change the value for an individual user with the usermod(ADM) command by omiting the -D option and appending the user name to the above command.
See also:
Specific dial-in lines that require passwords are defined in the file /etc/dialups. The format is one tty device name per line, for example:
/dev/tty1A /dev/tty5CThe actual dialup passwords are kept in the file /etc/d_passwd. The password format is the same one used in /etc/passwd. The first field (``user name'') in /etc/d_passwd is not a user name, but the name of a shell program (for example, /bin/sh) used in /etc/passwd. If the login shell of the user attempting to log in (on a tty line listed in /etc/dialups) is listed in /etc/d_passwd, then the user is prompted for the dial-in password stored in /etc/d_passwd.
Use this command line for creating a dial-in password:
passwd -m dialname
Change the password for dialup shell dialname
(listed in /etc/d_passwd). If dialname
begins with a slash (/) the entire shell name must match.
Otherwise the password for every shell whose basename is dialname
is changed. Only the superuser can change a dialup shell password.
Setting login restrictions
Login restrictions help protect your system by locking out
unauthorized users. These restrictions make it difficult
for an unauthorized user to use repeated login attempts to guess
a user password and gain entry:
In the Account Manager, select a user name, then select Login Controls from the Users menu.
Enter a value in the ``Failed login attempts allowed before account is locked'' field or click on the default of button to select the system default.
To lock or unlock an account, see ``Locking or unlocking a user account''.
To change the system default value, use this command line:
usermod -D -x "{maxLoginAttempts value}"
You can change the value for an individual user with the usermod(ADM) command by omiting the -D option and appending the user name to the above command.
See also:
Use the Terminal Manager located in the System directory of the SCOadmin hierarchy. To set login restrictions on all terminals, select Defaults. To change the settings for an individual terminal, select Examine.
You can control these attributes:
Wait for login retry:
is displayed between login attempts.
See also:
To lock an account, click on the Lock Account button. When an account has been locked, the Unlock Account button appears instead.
If a lock has been applied to the account, it is listed under ``Current Account Lock Status''. An account can be locked because:
You can also unlock accounts from the command line:
passwd -u username
To lock an account, use the -l option.
See also:
Use the Terminal Manager located in the System directory of the SCOadmin hierarchy. To lock and unlock a terminal, respectively, select Lock or Unlock. When the prompt appears for the terminal, enter the name, (for example: tty01). When a terminal is locked, this message is displayed when an attempt is made to log in:
Terminal is disabled -- see Authentication Administrator
The Low and Traditional
security profiles
assign most of the capabilities described here
by default and it should not be necessary to change them.
With the High (C2) security profiles, few are assigned
by default; most privileges are intended for users entrusted with
system administration.
Assigning subsystem authorizations
Authorizations allow users to run certain system programs.
Primary authorizations
are intended for users entrusted with system administration.
Secondary authorizations
grant more limited capabilities.
In the Account Manager, select the user name, then select Authorizations from the Users menu.
To change authorizations, deselect the Use system default authorizations for this user account button. This allows you to assign a set of authorizations specific to this account.
To add an authorization, select an entry the ``Not authorized'' column and click on the Add button.
To remove an authorization, select an entry in the ``Authorized'' column and click on the Remove button.
To change the authorizations assigned by default,
use this command:
usermod -D -x "{subsystemAuths {list}}"
where list is one or more authorizations separated by spaces.
You can change the value for an individual user with the
usermod(ADM)
command by omiting the -D option
and appending the user name to the above command.
Primary authorizations
Primary authorizations effectively divide superuser powers into
subsystems, allowing you to assign only the capabilities you want
the user to have. Use
secondary authorizations
to assign more limited capabilities to normal users.
Users lacking the required authorization to run a SCOadmin manager
will see the message You are not authorized to run...
Table 1-2 Primary authorizations
----------------------------------------------------------------------------
Authorization SCOadmin Powers
Manager
----------------------------------------------------------------------------
mem − access to system data tables, listing
all processes on the system
terminal − unrestricted use of the write(C)
command
lp Printer Manager administer printers
backup Backup Manager perform backups
auth Account Manager administer accounts and terminals:
Terminal Manager adding users, changing passwords,
controlling logins
audit Audit Manager run system audits and generate reports
cron Cron Manager control use of cron(C) at(C) and
batch(C) commands
root − use any command found in
/tcb/files/rootcmds -- see ``Allowing
users to execute superuser commands''
sysadmin Filesystem Manager alter mount configuration
passwd - manage system passwords using passwd(C)
Secondary authorizations
Secondary authorizations allow limited access by users to
resources that would otherwise be tightly controlled (for example,
without the printqueue authorization, users would only be
able to see their own jobs when they use the lpstat command).
They are useful when running the Improved or High security profiles
to provide behavior that is
more consistent with other UNIX systems.
Table 1-3 Secondary authorizations
-----------------------------------------------------------------------
Secondary Parent Powers
authorization authorization
-----------------------------------------------------------------------
audittrail audit generate personal audit reports on
one's own activities
backup_create backup create (but not restore) backups
restore backup restore (but not create) backups
queryspace backup use df(C) command to query disk space
printqueue lp view all jobs in queue using lpstat(C)
printerstat lp use printer enable/disable commands
su auth access the root (superuser) account and
other accounts. Access still requires
a password; see ``Accessing other
accounts with su(C)'' for more
information.
shutdown root use the Shutdown Manager or shutdown in
conjunction with the asroot(ADM)
command as described in ``Allowing
users to execute superuser commands''
Changing system privileges
System privileges
allow user processes to execute specific
operating system services. For example, the ability to change
ownership of a file is governed by the chown privilege.
(The chown privilege allows the use of the
chown(S)
system call that enables
chown(C)
to work.)
In the Account Manager, select the user name, then select Privileges from the Users menu.
To change privileges assigned, deselect the Use system default privileges for this user account button. This allows you to assign a set of privileges specific to this account.
To add a privilege, select an entry the ``Not allowed'' column and click on the Add button.
To remove a privilege, select an entry in the
``Allowed''
column and click on the Remove button.
To change the privileges assigned by default, use this command:
usermod -D -x "{privs {list}}"
where list is one or more privileges separated by spaces.
You can change the value for an individual user with the usermod(ADM) command by omiting the -D option and appending the user name to the above command.
Table 1-4 System privileges
---------------------------------------------------------------------------------- Privilege Allows user processes to ---------------------------------------------------------------------------------- configaudit configure audit subsystem parameters writeaudit write audit records to the audit trail execsuid run set-UID programs chmodsugid to set set-UID and set-GID bit on files chown to change the owner of an object suspendaudit suspend operating system auditing of the process
Under the Low and Traditional security profiles, most system privileges are assigned by default and should not require modification. Under the High security profile, chmodsugid is not assigned by default. Most users require only execsuid to perform routine tasks. If the user needs to create files with the SUID or SGID bits, they must have chmodsugid. To change ownership of a file (``give it away''), the chown privilege is required. If a user does not have this privilege, ownership of files can only be changed by root. The audit privileges (configaudit, writeaudit, and suspendaudit) should never be assigned to anyone other than the audit administrator. They are intended for use by a program designed to run as a trusted application.
See also:
Table 1-5 Subsystem privilege requirements
--------------------------------------------------------------------------------- Subsystem Privilege required authorization --------------------------------------------------------------------------------- audit configaudit, execsuid, writeaudit auth execsuid, chown backup execsuid lp chown cron chmodsugid, chown, execsuid sysadmin chmodsugid, chown, execsuid
ALLOWHUSH=YESUsers can then create an empty file called .hushlogin in their home directory that suppresses login messages.
The procedure for setting up a superuser command for this usage is described in detail in the asroot(ADM) manual page.
See also:
su prompts for the account password, and if it is correct, a Bourne shell is started under the other account. Transitions with su do not affect the login user ID (LUID), so login and audit records remain accurate.
If a dash (-) is included in the command (su -), the environment for that user is executed (including login shell, home directory, and so forth), making it essentially the same as logging in as that user. To exit the shell, enter exit or press <Ctrl>D and you are returned to your own account.
Users can su to an pseudo-user account if they own it. To access the root account (or any other account they are not responsible for), however, the user must have the su authorization. Refer to ``Assigning subsystem authorizations'' for more information.
See also:
SU 07/08 22:32 + ttyp0 mavrac-rootThe entry indicates the date, time, location, and name of the account using the command. The following information is logged if an entry for SULOG appears in /etc/default/su:
SULOG=/usr/adm/sulog
See also:
The Cron Manager performs these tasks:
See also:
To change the system defaults,
make these selections in the Cron Manager
(the first is for cron and the second for at
and batch):
Authorize
Authorize
These three selections are displayed:
The current behavior is highlighted.
Use the arrow keys to select the behavior desired, or
enter the first letter.
Remember that users can be allowed or denied on an
individual basis as well.
The settings for individuals take precedence over the system defaults.
Changing the job scheduling permissions for a user
To change individual user permissions, make these selections
in the Cron Manager
(the first is for cron and the second for at
and batch):
Authorize
Authorize
The cursor is placed on the ``User:'' field. Enter the name of the user or press <F3> for a list of possible users. When the user name is selected, these selections are displayed:
Use the arrow keys to select the behavior required.
This setting overrides the system default.
Using environment files for the at or batch commands
It is also possible to define the environment in which at
and batch commands execute.
To edit the at and batch prototype files respectively,
use these selections in the Cron Manager:
Authorize
Authorize
These options edit the files /usr/lib/cron/.proto (for at) or /usr/lib/cron/.proto.b (for batch). These files are placed at the start of the shell script formed for all at and batch jobs. This script must conform to the usual /bin/sh syntax and contain some variables particular to the prototype file. These variables are:
nice -5 /bin/sh << 'END_OF_FILE' $< END_OF_FILE
/bin/csh << 'END_OF_FILE' $< END_OF_FILE
For most sites, the prototype files provided with the
distribution should be sufficient.
Changing the system security profile
You were asked to choose a
security profile
at installation time.
It is possible to later select a different profile by using the
Security Profile Manager located in the System/Security
directory
of the SCOadmin hierarchy.
Use the Current security profile button to change the profile and select Save from the Security menu to save the new profile. You may be asked to reboot your system before the change takes effect.
These profiles are available:
You can change the security profile from the command line using
relax(ADM).
For example, this command sets the Improved profile:
relax improved
The security profiles are merely a set of values that can be customized
as desired. If The security subsystem has been
modified appears on the screen, that means that you
have made changes to individual
security parameters. Customized values are overwritten when you
select a new profile.
Security profiles
A security profile is a set of pre-configured values for
parameters that control the security behavior of your system,
such as how long passwords last, or what privileges are assigned
to users. Once you choose a profile, you can switch to another
profile, or change any one of the dozens of parameters
on an individual basis.
Table 1-6 System security profiles
------------------------------------------------------------------------------------------------
Security profiles
Security parameters Low Traditional Improved High
------------------------------------------------------------------------------------------------
Passwords
------------------------------------------------------------------------------------------------
Minimum days between changes 0 0 0 14
Expiration time (days) infinite infinite 42 42
Lifetime (days) infinite infinite 365 90
User can choose own yes yes yes no
User can run generator yes yes yes yes
Maximum generated length 8 8 10 10
Minimum length 1 3 5 8
Password triviality checks none System V goodpw weak1 goodpw strong2
Password obviousness checks - no no1 yes2
Password required to login no no yes yes
Single user password required yes yes yes yes
------------------------------------------------------------------------------------------------
Logins
------------------------------------------------------------------------------------------------
Maximum unsuccessful attempts infinite 99 5/9 3/5
(account/terminal)
Delay between login attempts (secs) 0 1 2 2
-- terminal only
Time to complete login (secs) -- 60 60 60 60
terminal only
------------------------------------------------------------------------------------------------
Authorizations
------------------------------------------------------------------------------------------------
Primary backup, mem, none none
lp, mem, terminal,
terminal
------------------------------------------------------------------------------------------------
Secondary audittrail, audittrail, audittrail, queryspace
queryspace, printqueue, queryspace,
shutdown, su queryspace, printqueue,
su su
------------------------------------------------------------------------------------------------
Privileges
------------------------------------------------------------------------------------------------
chmodsugid, chmodsugid, chmodsugid, chown,
chown, chown, chown, execsuid
execsuid, execsuid execsuid
suspendaudit
------------------------------------------------------------------------------------------------
Default umask3 022 022 027 077
------------------------------------------------------------------------------------------------
C2 Features
LUID enforcement4 no no no yes
STOPIO on devices4 no no no no
SUID/SGID clear on write4 no yes yes yes
Users can be deleted5 yes yes no no
Database corruption6 recover recover lockout lockout
Database precedence7 System V System V TCB TCB
------------------------------------------------------------------------------------------------
Other
------------------------------------------------------------------------------------------------
Users can schedule jobs allow allow deny deny
Home directory permissions 755 755 750 700
Dialup printers allowed yes yes no no
Hushlogin allowed8 yes yes yes no
Password for asroot(ADM) no no no yes
Significant characters in passwords 8 8 80 80
su(C) use logged no yes yes yes
/etc/shadow present no yes yes yes
Notes:
System V files:
TCB files:
Configuring database precedence and recovery
When the Low or Traditional security profiles are configured on
your system, inconsistencies between the TCB and
UNIX System V database files are handled transparently without
interrupting system operation. Under the higher security
profiles, the TCB database files take precedence and
any corruption or inconsistencies that occur result in a
lockout of non-root users until the problem is corrected.
This behavior can be set independently of the security profile with the usermod(ADM) command.
To reconfigure database precedence, use this command:
usermod -D -x "{tcbDatabaseIsMaster value}"
where value is either 1 (yes) or 0 (no). If you set value to 0, the UNIX System V database files described in ``Understanding account database files'' are used as the master. The non-master database files are maintained only for consistency and are not relied upon for data used by the system.
To reconfigure how the system treats inconsistencies,
use this command:
usermod -D -x "{integrityRequired value}"
where value is either 1 (lock out all users until problem is fixed) or 0 (generate warnings but do not lock out users). If set to 1, the administrator must log in on the override terminal as described in ``Using the override terminal''.
See also:
See also:
See also:
Account information is gathered from the /etc/passwd
file and the Protected Password database.
Irrelevant information about the user (including
unsuccessful logins, unsuccessful password changes, and the
location and time of last login) is not included in the profile.
To create a profile and install it on another machine:
where usernames is the list of one or more user names.
The new account information is in place and ready for use.
See also:
See also:
See also:
To reconfigure the number of significant segments, use the command:
usermod -D -x "{passwdSignificantSegments value}"
where value is from 1 to 10. A value of 1 (instead of the 10 used in the Improved or High defaults) allows the encryption mechanism to ignore characters following the first eight, thus allowing complete compatibility with other systems.
See also:
Unable to create new user account: nameError boxes of this type include a Details button to provide you with additional information. The problems reported fall into these categories:
The user name does not exist in /etc/passwdThis means that an account database entry in /etc/passwd is corrupted or the file itself is missing. Table 1-7 contains a list of critical files accessed by the Account Manager. Follow these steps to solve the problem:
This will list any missing database files.
authck will regenerate the Protected Password database entry for root (/tcb/files/auth/r/root) and any other users it finds missing.
Table 1-7 Security-related files
Filename Purpose ------------------------------------------------------------------ /etc/auth/system/default Default control database /etc/auth/system/authorize Authorization database /etc/default/accounts Account/group creation defaults /etc/group Group database /etc/passwd Account database /tcb/files/auth Protected Password database directory
See also: