Dear list, Can I prevent to change secoff's password by the root? To specify: all another user password change must be allowed by root, except the secoff's password. I could not set up that (I use the "normal" PAM, not the rsbac-um). Can the rsbac-um solve my problem, or another ideas? Thanks, Tamas
Dear List, Sorry if this is a dummy question, I'm new in rsbac. How can I change the security models roles default rigths? (eg. MAC Role for an user can be Administrator, Security Officer, General user or Auditor). I could create custom role only for RC. Maybe I made anything wrong? Any suggestions please? Reagrds, Tamas
> Can I prevent to change secoff's password by the root? To specify: all > another user password change must be allowed by root, except the > secoff's password. I could not set up that (I use the "normal" PAM, > not the rsbac-um). Can the rsbac-um solve my problem, or another ideas? Yes I believe that rsbac-um will be able to solve your problem. AFAIK, that is probably the best way of doing this. -- chirag
Hello, > Sorry if this is a dummy question, I'm new in rsbac. > How can I change the security models roles default rigths? (eg. MAC > Role for an user can be Administrator, Security Officer, General user > or Auditor). I could create custom role only for RC. > Maybe I made anything wrong? For MAC, I don't think that you can create a MAC custom role - nor do I think that you can modify the default rights for the already created roles (unless of course you modify source code). -- chirag
With the um module I think you can do it as you can see here: http://gentoo-wiki.com/RSBAC,_Who_is_root_anyway%3F 2006/8/1, Tamas Orosz <tamas.orosz <at> groupama.hu>: > Dear list, > > Can I prevent to change secoff's password by the root? To specify: all > another user password change must be allowed by root, except the > secoff's password. I could not set up that (I use the "normal" PAM, > not the rsbac-um). Can the rsbac-um solve my problem, or another ideas? > > Thanks, > Tamas > _______________________________________________ > rsbac mailing list > rsbac <at> rsbac.org > http://www.rsbac.org/mailman/listinfo/rsbac >
One question, why do you want to change them¿? I think MAC is not for manage roles. I believe that the purpose of MAC, FF, and others modules roles is to permit the separation of the administration tasks of each model in an independent way, as is, it's only an add-on, not a characteristic of the model (for me). AFAIK, MAC as is, is not prepared to use RBAC (well the categories is a tiny approach). If you want roles use the Role Compatibility model and if you would like them use both (an RC model and on top a MAC model), to get one role access control based on rings. 2006/8/3, Chirag Pandya <cpandya <at> gmail.com>: > Hello, > > > Sorry if this is a dummy question, I'm new in rsbac. > > How can I change the security models roles default rigths? (eg. MAC > > Role for an user can be Administrator, Security Officer, General user > > or Auditor). I could create custom role only for RC. > > Maybe I made anything wrong? > > For MAC, I don't think that you can create a MAC custom role - nor do > I think that you can modify the default rights for the already created > roles (unless of course you modify source code). > > > -- > chirag(Continue reading)
e.g. you make a special role "user admin" who is able to change passwords, while other users including 'normal root' is not able to run passwd command, or only 'system administrator' (root) is not able to run passwd. Yes, this means that 'user admin' can change the password of secoff. next tip: you disable to su or sudo to secoff, only accept ssh'ing to secoff with rsa key from outside machine. This way it does not really count if a root can change the password of secoff. So there is no simple solution but you can manage to make your own way to protect secoff.. On Tue, 1 Aug 2006, Tamas Orosz wrote: > Dear list, > > Can I prevent to change secoff's password by the root? To specify: all > another user password change must be allowed by root, except the > secoff's password. I could not set up that (I use the "normal" PAM, > not the rsbac-um). Can the rsbac-um solve my problem, or another ideas? > > Thanks, > Tamas > _______________________________________________ > rsbac mailing list > rsbac <at> rsbac.org > http://www.rsbac.org/mailman/listinfo/rsbac > >(Continue reading)
hi liste i have a problem with my ssh. the follow situation i have. i give the sshd a initial rc-role and force role. now when i will offer the root password for the ssh access i get the the ssh-force-rc-role has access to the directory /security for manage the rsbac over ssh. now the same ssh-force-rc-role give the root-user the entry. and the root user get all rights for the /security directory like the security-user. and this directory is the only where i give the ssh-force-rc-role acces to write etc. . now the root-user which come with the ssh-force-rc-role into the system get also all this rights there. there the rc-type not differ betwen the users, because the ssh-force-role ask for access. for this situation i need an other model to protect this directory. there is no problem if i do with direct keyboard access to the machine, because then the rc-role 2 has no access the the rc-type from /security. but when i will do over ssh is it a problem. sincerly igraltist
RSS Feed18 | |
|---|---|
6 | |
5 | |
14 | |
2 | |
8 | |
4 | |
10 | |
2 | |
8 | |
18 | |
7 | |
7 | |
17 | |
31 | |
6 | |
3 | |
2 | |
18 | |
6 | |
1 | |
17 | |
11 | |
13 | |
6 | |
1 | |
8 | |
14 | |
10 | |
3 | |
3 | |
2 | |
8 | |
2 | |
3 | |
27 | |
7 | |
8 | |
1 | |
10 | |
6 | |
15 | |
22 | |
15 | |
6 | |
8 | |
14 | |
1 | |
8 | |
70 | |
13 | |
37 | |
12 | |
4 | |
3 | |
11 | |
13 | |
1 | |
5 | |
2 | |
3 | |
12 | |
9 | |
20 | |
13 | |
36 | |
13 | |
34 | |
30 | |
12 | |
8 | |
10 | |
10 | |
11 | |
10 | |
28 | |
44 | |
56 | |
37 | |
8 | |
23 | |
27 | |
21 | |
36 | |
15 | |
15 | |
18 | |
30 | |
25 | |
58 | |
39 | |
37 | |
27 | |
39 | |
58 | |
43 | |
20 | |
21 | |
42 | |
21 | |
48 | |
28 | |
59 | |
46 | |
48 | |
57 | |
28 | |
27 | |
60 | |
36 | |
59 | |
63 | |
23 |
