After installation and configuration are completed, the System Administrator (admin) role configures users. The Security Administrator (secadmin) role can specify security attributes for individual user accounts if the default system-wide values are not appropriate. The Security Administrator is also able to change many of the system-wide default values, if desired.
See these sections below:
NOTE: The recommended names and login names for the roles are used in the SMC help. The names are recommended during configuration when the roles are created because they are the names that are used throughout the documentation. Creating roles with other names may lead to confusion when people try to follow the procedures.
The Security Administrator role can also modify default roles and rights profiles and can add new roles and profiles, when the roles and profiles do not require more capabilities that the Security Administrator role has to give away.
Primary Administrator (primaryadmin)
can be also be used at sites whose administrators are
experienced in role-based access control if a need arises for changes to the
rights profiles or roles.
All Role's Initial Access to SMC User's Tools
Each role brings up the Solaris Management Console in an administrative role workspace, double-clicks the Users tool, enters the role's password, and then uses the tools as described below to configure users.
Starts the SMC.
Opens a toolbox with the correct scope.
On a NIS master, Scope=NIS, on a NIS+ master, Scope=NIS+. On a standalone or name service client, Scope= either files, NIS, or NIS+, depending on which name service is used, if any.
If the desired toolbox is not displayed in the SMC navigation pane, selects Console->Open Toolbox, selects and loads the desired server, and double-clicks on the appropriate toolbox.
Double-clicks Trusted Solaris Configuration and then Users.
Top
Primary Administrator's Access to SMC Users Tools
The Primary Administrator role can do anything the
UNIX root user can do and anything all other Trusted Solaris
administrative roles can do.
Because
the Primary Administrator role is so powerful, sites are strongly cautioned to make the
role available only to highly trusted individuals for use
only in
exceptional circumstances.
The Primary Administrator role can be used
when the Security Administrator role cannot do something, such as
configuring a role or rights profile that needs attributes the Security Administrator role does not have.
For example, access to most of the fields in the SMC is controlled by authorizations. Because the Security Administrator role does not have all authorizations, the Security Administrator role is not able to grant all authorizations, and so the Security Administrator role could not create another role that could access all fields of the SMC. The Primary Administrator role can grant all authorizations, because the role has the "All Solaris Authorizations" authorization, which includes the authorization called "Grant All Solaris Authorizations." (See the auth_attr(4) man page for more information about the available authorizations. See also the Trusted Solaris Administrator's Procedures for how to manage and how to add new authorizations, if needed.)
When the System Administrator role adds a user account using either the User Wizard or a Template, only Solaris attributes can be specified. To provide each user account with a full set of extended Trusted Solaris security attributes, a set of default security attributes is implictly applied to all user accounts.
A default label view, a minimum label, and a clearance are defined in the label_encodings(4) file, and other defaults are specified in the policy.conf(4) file, as explained in their man pages . When the default security attributes are not acceptable, the security administrator can specify other system-wide values or can modify the attributes for individual accounts using the User Accounts tool. For more details, see About User and Role Accounts.
Top
System Administrator's Access to SMC Users Tools
Adds new users from a pre-existing template or uses a wizard. Can also define some default behaviours (called User Policies in the SMC) that apply when creating and deleting user and role accounts.
Add User
|
||||
Copy to Group or Mailing List | ||||
Add Multiple Users
|
||||
User Policies (to define defaults) | ||||
Properties (to modify certain properties on an already-created account) |
Copies one or more users and adds user(s) to a group or mailing list.
NOTE: Before starting this, the user(s), the desired group, and/or the desired mailing list must already exist.
Copy to Group or Mailing List |
Paste User(s) into Group
or Paste User(s) into Mailing List |
Configures user templates
Add User Template |
Clone User Template |
Properties--NOTE: This option is only available when an existing template is first selected. |
Modifies certain user properties after account creation
Double-clicks the User Accounts tool.
Double-clicks the name of the user account to modify.
Can access any of the tabs shown on the left and edit any of the values shown on the right below.
General | |
User Name | |
Description | |
Full Name | |
Shell | |
Group | |
Primary Groups | |
Additional Groups | |
Home Directory | |
Path | |
Automount | |
Share | |
NOTE: Mail field is Read Only. |
Creates a group.
Double-clicks the Groups tool.
Add Group |
Paste User(s) into Group |
Properties |
Creates a mailing list.
Double-clicks the Mailing Lists tool.
Add Mailing List |
Paste User(s) into Mailing List |
Properties |
Deletes a user, group, or mailing list.
Double-clicks the User Accounts, Groups, or Mailing Lists tool.
Modifies security-relevant attributes of users, if needed.
Can access any of the tabs shown on the left to edit any of the values shown on the right below.
Password | |
User Password--Creates a password to assign to the user either by choosing from a generated list or typing one in. | |
Update Password--Specifies the method by which the user is able to choose a new password, either by choosing from a generated list or typing one in. | |
Password Options | |
Password Options in Days --Specifies the days the user must keep the password, how many days before password expiration to alert the user, how long the user can keep the same password, and the number of days before the password expires if not used. | |
Rights | |
Assigns existing rights profiles to the user account. | |
Roles | |
Assigns roles to the user account.
NOTE: Roles can also be assigned using the Action menu's Add Role option. |
|
Trusted Solaris Attributes | |
Labels-- Assigns a minimum label, clearance, and specifies whether the user sees labels and in what form the labels are to be displayed. | |
Account Usage | |
Specifies whether the account is to be locked after a number of failed login attempts, and whether the session is to be terminated or the screen locked after a certain amount of idle time. |
Reconfigures roles or adds new roles.
Any previously-defined roles display in the right pane.
From the Action menu, selects one of the following:
Add Administrative Role
Assign Administrative Role Assign Rights to Role Properties--This option is only available when an existing role is first selected. |
Reconfigures rights profiles or adds new rights profiles.
All previously-defined rights profiles display.
From the Action menu, selects one of the following:
Add Rights
Properties--NOTE: This option is only available when an existing rights profile is first selected. |