Manage Roles and Profiles

This task covers the following activities:

• Creating a role

• Creating or changing a rights profile • Assigning a rights profile to a role (added) • Assigning a role to a user

• Assuming a role

• Restricting an administrator to explicitly assigned rights

1. Double-click the Sol11-Server1 icon to launch the Sol11-Server1 virtual machine. 2. Log in to the virtual machine Sol11-Server1 as the oracle user. Use the password

oracle1.

3. Run the su - command to assume privileges.

oracle@s11-serv1:~$ su - Password:

root@s11-serv1:~#

4. Use the roleadd command to add a role called sdown. Using the passwd command,

create a password for the sdown role.

root@s11-serv1:~# roleadd -u 3000 -g 10 -m -d /export/home/sdown sdown

80 blocks

root@s11-serv1:~# passwd sdown New Password: sdown123

Re-enter new Password: sdown123

passwd: password successfully changed for sdown

A new role is added and the password created. Use the password sdown so it can be remembered easily.

Oracle Internal & Or

5. Let’s verify the entries created in various files.

root@s11-serv1:~# grep sdown /etc/passwd sdown:x:3000:10::/home/sdown:/usr/bin/pfbash root@s11-serv1:~# grep sdown /etc/user_attr sdown::::type=role;profiles=All;roleauth=role

As you can see, an entry in /etc/passwd was created very much like an entry for a new user. Notice the default shell.

An entry was also made in /etc/user_attr for sdown, which is marked as a role. 6. Using the vi editor, add an entry in the /etc/security/prof_attr file for the new

Shut profile.

root@s11-serv1:~# vi /etc/security/prof_attr

root@s11-serv1:~# grep Shut /etc/security/prof_attr Shut:::Able to shutdown the system:

Here you created a new rights profile called Shut.

7. Use the rolemod command to assign the profile Shut to the sdown role.

root@s11-serv1:~# rolemod -P Shut sdown Found user in files repository.

root@s11-serv1:~# grep sdown /etc/user_attr sdown::::type=role;profiles=Shut;roleauth=role root@s11-serv1:~#

Note the profiles entry in the /etc/user_attr file.

8. Create a user called abell and assign her the sdown role. Create a password. Confirm that an entry is made in the /etc/user_attr file.

root@s11-serv1:~# useradd -u 4009 -g 10 -m -d /export/home/abell -s /bin/bash -R sdown -c "anna bell" abell

80 blocks

root@s11-serv1:~# passwd abell New Password: oracle1

Re-enter new Password: oracle1

passwd: password successfully changed for abell root@s11-serv1:~# grep abell /etc/user_attr abell::::type=normal;roles=sdown

Note the entry in /etc/user_attr for Anna Bell with the sdown role. Why? Because

she has been assigned the role sdown.

Note: Create this user only if it is not already there.

Oracle Internal & Or

9. Add an entry in the /etc/security/exec_attr file for the Shut profile. Confirm this by using the grep command.

root@s11-serv1:~# vi /etc/security/exec_attr

root@s11-serv1:~# grep Shut /etc/security/exec_attr Shut:suser:cmd:::/usr/sbin/shutdown:uid=0

10. Now, log in as Anna Bell and use the shutdown command to reboot the system. root@s11-serv1:~# su - abell

Oracle Corporation SunOS 5.11 snv_173 August 2011

abell@s11-serv1:~$ /usr/sbin/shutdown -i 6 -g 0

/usr/sbin/shutdown: Only root can run /usr/sbin/shutdown

As expected, Anna Bell does not have the privileges to shut down the system. 11. Execute the profiles and roles commands to determine Anna’s privileges.

abell@s11-serv1:~$ profiles Basic Solaris User

All

abell@s11-serv1:~$ roles sdown

Anna has been assigned the sdown role. When? When her account was created 12. Log in with the sdown role and use the init command to shut down the system.

abell@s11-serv1:~$ su sdown Password: sdown123

sdown@s11-serv1:~$ id

uid=3000(sdown) gid=10(staff)

sdown@s11-serv1:~$ /usr/sbin/init 6 init: unable to open /dev/fb to load the shutdown image

bootadm: you must be root to run this command Must be super-user

Why can’t Anna reboot the system? She is not allowed the privilege of using the init

command.

13. Using the profiles –l command, obtain the privileged commands that Anna can use.

abell@s11-serv1:~$ profiles -l Shut

Basic Solaris User

auths=solaris.mail.mailq,solaris.device.mount.removable,sol aris.admin.wusb.read

profiles=All

Oracle Internal & Or

/usr/bin/cdrecord.bin privs=file_dac_read,sys_devices,proc_lock_memory,proc_priocntl,ne t_privaddr /usr/bin/readcd.bin privs=file_dac_read,sys_devices,net_privaddr /usr/bin/cdda2wav.bin privs=file_dac_read,sys_devices,proc_priocntl,net_privaddr All *

Does the sdown role have the privilege to execute the init command? No. Can this role execute the shutdown command? Yes, as part of the Shut profile. 14. Now use the shutdown command to attempt to bring down the system. To save time,

respond with n which prompted to continue shutting down.

abell@s11-serv1:~$ /usr/sbin/shutdown -i 6 -g 0

Shutdown started. Thursday, October 20, 2011 05:24:30 AM MDT

Do you want to continue? (y or n): n

Broadcast Message from root (pts/2) on s11-desktop Thu Oct 20 05:24:38...

False Alarm: The system s11-desktop will not be brought down. showmount: s11-desktop: RPC: Program not registered

Shutdown aborted.

Were you able to execute the shutdown command? Yes.

15. Use the profiles command to display the profiles assigned to the sdown role. abell@s11-serv1:~$ profiles

Shut

Basic Solaris User All

The sdown profile has three profiles assigned: Shut, Basic Solaris User, and All. 16. Log out of the sdown role and Anna’s account.

sdown@s11-serv1:~$ exit exit

abell@s11-serv1:~$ exit logout

Oracle Internal & Or

17. Now you want to delete the Shut profile from the profiles assigned to the sdown role. Use the rolemod command to delete the profile.

root@s11-serv1:~# rolemod -P "Basic Solaris User,All,Stop" \ sdown

Found user in files repository. root@s11-serv1:~#

Referring to the output in Step 16, by using the Stop profile, you are taking away the Shut profile from sdown. This command is especially useful if you have many (e.g. 15) profiles assigned to a role and you want to limit the role to only a few profiles.

18. Log in to Anna Bell’s account, assume the sdown role, and attempt to use the shutdown command as before.

root@s11-serv1:~# su - abell

Oracle Corporation SunOS 5.11 snv_173 August 2011

abell@s11-serv1:~$ su sdown Password: sdown123

sdown@s11-serv1:~$ /usr/sbin/shutdown -i 6 -g 0

/usr/sbin/shutdown: Only root can run /usr/sbin/shutdown sdown@s11-serv1:~$ exit

exit

You are back to where Anna Bell can’t issue the shutdown command using the sdown role. If you display the current profiles assigned to sdown, you see only the remaining profiles.

abell@s11-serv1:~$ profiles Basic Solaris User All

abell@s11-serv1:~$