To answer a question that you didn't ask, sudo is an excellent
alternative to su(1m), with the ability to selectively allocate root
commands to users.
It is also much simpler than RBAC for the scenario you've described.
Here's an example sudoers file:
User_Alias WEBADMIN = user1,user2,user3
WEBADMIN ALL = (root)
/opt/app/iplanet/https-myserver/start, \
/opt/app/iplanet/https-myserver/stop
And an example usage:
host> id
uid=1001(user1)
host> sudo /opt/app/iplanet/https-myserver/start
Password:
[ . . . command runs . . . ]
By default, sudo prompts for the user's own password. This means that
you can lock the root password in a safe, and only get it out for
single-user mode. You can also configure it to prompt for the target
user's password, or no password at all (on a per-command basis).
Sudo requires no special shells or any other changes to your user's
environment. It's available on the Companion Software CD since Solaris
8.
-----Original Message-----
From: Jonathan Katz [mailto:jonathan.katz@gmail.com]
Sent: Wednesday, 13 April 2005 4:50 AM
To: focus-sun@securityfocus.com
Subject: (mis)using RBAC...
All,
I was recently charged with setting up RBAC so that the group I work
with will 'su to root' less often.
The first project I've picked is to either establish a role and/or
profile that will allow a normal user to start and stop our
webservers. Here is what I came up with, bypassing the concept of a
'role'...
1) I created a profile called "Web Administration"
in /etc/security/prof_attr
Web Administration:::Role for restarting webservers::
2) I gave the profile the ability to run the start and stop webserver
scripts as root:
in /etc/security/exec_attr
Web
Administration:suser:cmd:::/opt/app/iplanet/https-myserver/start:uid=0
Web
Administration:suser:cmd:::/opt/app/iplanet/https-myserver/stop:uid=0
3) I then added the role to my account on the server in /etc/user_attr:
jkatz::::type=normal;profiles=Web Administration,Basic Solaris User
4) Finally, I changed my shell to /bin/pfcsh. Now, with my regular
user account I can start and restart our webservers.
My questions are, is this a normal practice (are there other people
doing it) and is it supported? What unintended consequences am I
missing? I understand that if a user's account is compromised, the
webserver services can be stopped and started at-will. I also
understand that our sysadmin group will be restricted to using
pfcsh/pfksh/pfsh and cannot use bash or tcsh (although we can still
leave those set, type 'exec pfsh' and then do what we need to do as
the Profile.)
Thanks!
--
-Jon
Jonathan Katz -- J. Random BOFH
