Re: (mis)using RBAC...

Jonathan Katz schrieb:

>All,
>
>I was recently charged with setting up RBAC so that the group I work
>
...

> I then added the role to my account on the server in /etc/user_attr:
>jkatz::::type=normal;profiles=Web Administration,Basic Solaris User
>
>  
>
you added a right profile. I missed the right profile "All" in this entry.

>4) Finally, I changed my shell to /bin/pfcsh. Now, with my regular
>user account I can start and restart our webservers.
>
>My questions are, is this a normal practice (are there other people
>doing it) and is it supported? What unintended consequences am I
>missing? I understand that if a user's account is compromised, the
>webserver services can be stopped and started at-will. I also
>understand that our sysadmin group will be restricted to using
>pfcsh/pfksh/pfsh and cannot use bash or tcsh (although we can still
>leave those set, type 'exec pfsh' and then do what we need to do as
>the Profile.)
>
>  
>
It looks valid to me . To avoid error you should use usermod, 
smprofile,  etc ...  to modify the RBAC databases.
Another way, less invasive perhaps,  is to use pfsh as interpreter in 
the start/stop script or use a "pf" wrapper to call them.

On Solaris10 you should try to give the http daemon the privilege to 
open privileged port "PRIV_NET_PRIVADDR" so it doens't need to be start 
as root :)

regards
benjamin