Getting Started With Users Tools

After installation and configuration are completed, the System Administrator (admin) role configures users. The Security Administrator (secadmin) role can specify security attributes for individual user accounts if the default system-wide values are not appropriate. The Security Administrator is also able to change many of the system-wide default values, if desired.

See these sections below:

NOTE: The recommended names and login names for the roles are used in the SMC help. The names are recommended during configuration when the roles are created because they are the names that are used throughout the documentation. Creating roles with other names may lead to confusion when people try to follow the procedures.

The Security Administrator role can also modify default roles and rights profiles and can add new roles and profiles, when the roles and profiles do not require more capabilities that the Security Administrator role has to give away.

Primary Administrator (primaryadmin) can be also be used at sites whose administrators are experienced in role-based access control if a need arises for changes to the rights profiles or roles.

All Role's Initial Access to SMC User's Tools

Each role brings up the Solaris Management Console in an administrative role workspace, double-clicks the Users tool, enters the role's password, and then uses the tools as described below to configure users.

  1. Starts the SMC.

  2. Opens a toolbox with the correct scope.

    On a NIS master, Scope=NIS, on a NIS+ master, Scope=NIS+. On a standalone or name service client, Scope= either files, NIS, or NIS+, depending on which name service is used, if any.

  3. If the desired toolbox is not displayed in the SMC navigation pane, selects Console->Open Toolbox, selects and loads the desired server, and double-clicks on the appropriate toolbox.

  4. Double-clicks Trusted Solaris Configuration and then Users.

Top

Primary Administrator's Access to SMC Users Tools

The Primary Administrator role can do anything the UNIX root user can do and anything all other Trusted Solaris administrative roles can do. Because the Primary Administrator role is so powerful, sites are strongly cautioned to make the role available only to highly trusted individuals for use only in exceptional circumstances. The Primary Administrator role can be used when the Security Administrator role cannot do something, such as configuring a role or rights profile that needs attributes the Security Administrator role does not have.

For example, access to most of the fields in the SMC is controlled by authorizations. Because the Security Administrator role does not have all authorizations, the Security Administrator role is not able to grant all authorizations, and so the Security Administrator role could not create another role that could access all fields of the SMC. The Primary Administrator role can grant all authorizations, because the role has the "All Solaris Authorizations" authorization, which includes the authorization called "Grant All Solaris Authorizations." (See the auth_attr(4) man page for more information about the available authorizations. See also the Trusted Solaris Administrator's Procedures for how to manage and how to add new authorizations, if needed.)

Default Extended Security Attributes

When the System Administrator role adds a user account using either the User Wizard or a Template, only Solaris attributes can be specified. To provide each user account with a full set of extended Trusted Solaris security attributes, a set of default security attributes is implictly applied to all user accounts.

A default label view, a minimum label, and a clearance are defined in the label_encodings(4) file, and other defaults are specified in the policy.conf(4) file, as explained in their man pages . When the default security attributes are not acceptable, the security administrator can specify other system-wide values or can modify the attributes for individual accounts using the User Accounts tool. For more details, see About User and Role Accounts.

Top

System Administrator's Access to SMC Users Tools

Top

Security Administrator's Access to SMC Users Tools

Top