HP Openvms Guide to System Security
Total Page:16
File Type:pdf, Size:1020Kb
HP OpenVMS Guide to System Security OpenVMS Version 7.3-2 This manual supersedes the OpenVMS Guide to System Security, Version 7.3-1. Manufacturing Part Number: AA-Q2HLG-TE September 2003 © Copyright 2003 Hewlett-Packard Development Company, L.P. Legal Notice PostScript is a trademark of Adobe Systems Incorporated. Microsoft is a US registered trademark of Microsoft Corporation. All other product names mentioned herein may be trademarks of their respective companies. Proprietary computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. ZK6346 2 Contents 1. Understanding System Security Types of Computer Security Problems . 22 Levels of Security Requirements. 23 Building a Secure System Environment. 24 Common Data Security Architecture (CDSA) . 25 Secure Sockets Layer (SSL). 26 Kerberos . 27 2. OpenVMS Security Model Structure of a Secure Operating System . 28 Reference Monitor Concept . 28 How the Reference Monitor Enforces Security Rules. 29 Implementation of the Reference Monitor . 29 Subjects . 29 Objects . 30 Authorization Database . 31 Audit Trail. 32 Reference Monitor. 33 Authorization Database Represented as an Access Matrix . 33 Summary: System Security Design. 34 3. Using the System Responsibly Choosing a Password for Your Account. 38 Obtaining Your Initial Password . 38 Observing System Restrictions on Passwords. 39 Knowing What Type of Password to Use . 39 Entering a System Password . 40 Entering a Secondary Password . 40 Password Requirements for Different Types of Accounts . 41 Types of Logins and Login Classes . 41 Logging In Interactively: Local, Dialup, and Remote Logins. 42 Logging In Using External Authentication. 42 Reading Informational Messages. 42 When the System Logs In for You: Network and Batch Logins . 43 Login Failures: When You Are Unable to Log In . 44 Using a Terminal That Requires a System Password . 45 Observing Your Login Class Restrictions . 45 Using an Account Restricted to Certain Days and Times . 45 Failing to Enter the Correct Password During a Dialup Login . 45 Knowing When Break-In Evasion Procedures Are in Effect . 46 Changing Your Password. 46 Selecting Your Own Password . 46 Using Generated Passwords. 47 Changing a Secondary Password . 48 Changing Your Password As You Log In . 48 Password and Account Expiration Times . 48 3 Contents Changing an Expired Password . 49 Renewing an Expired Account . 49 Guidelines for Protecting Your Password . 50 Network Security Considerations . 51 Protecting Information in Access Control Strings . 51 Using Proxy Login Accounts to Protect Passwords. 51 Auditing Access to Your Account and Files . 53 Observing Your Last Login Time . 53 Adding Access Control Entries to Sensitive Files . 54 Asking Your Security Administrator to Enable Auditing. 54 Logging Out Without Compromising System Security . 55 Clearing Your Terminal Screen . 56 Disposing of Hardcopy Output. 56 Removing Disconnected Processes. 56 Breaking the Connection to a Dialup Line . 57 Turning Off a Terminal . 57 Checklist for Contributing to System Security . 57 4. Protecting Data Contents of a User's Security Profile . 59 Per-Thread Security . 59 Persona Security Block Data Structure (PSB) . 60 Previous Security.