.

. , .

?

, . , , , .

, .

, U.S. Department of Defence . , D, C1, C2, B1, B2, B3, A.

"D" .

"C" . , , ( ) , .

"B" ( ). .

"A" , .

, .

"B" . "B", .

, .

AIX. , , . :

1) ;

2) " userid";

3) .

AIX. , . . UNIX . , userid , .

"" " userid" ( suid), . suid - (. ()); UNIX. suid.

AIX suid (shell scripts). AIX UNIX , .

( , ) , . , , , .

, , ( ) .

( , suid, ) UNIX.

. , . "" AIX "" .

, :

;
LAN;
, " ".

.

AIX

AIX , , (UID) . , UID . . , UID , , . root .

: root - adm, sys, bin, ... - .

, , . (GID). GID .

: system - user -

, . . .

, . , .

. :

, , , .

system. root.

. , staff . security .

.

:

system .

printq .

security

adm

staff

audit

AIX . . AIX - staff.

, , pgrp /usr/lib/security/mkuser.default. mkuser smit. , office, /usr/lib/security/mkuser.default : 

user :
    pgrp = staff

user :
    pgrp = office

: .

/etc/security/group admin. . /etc/security/group.

. admin=true /etc/security/group (. /etc/group /etc/security/group), . admin=true /etc/security/user (. /etc/security/user) , , adms /etc/security/group. admin=true, .

AIX. . root. ( 30 40 ) .

, su root. root, .

AIX , security. /etc/security (. ), . , security root. , .

userids

AIX userid , . , , , , :-). userid ( root).

, ( , /etc/passwd) . , NFS. , root, . ( = * /etc/security/passwd):

root:!:0:0:/:/bin/ksh
daemon:!:1:1::/etc:
bin:!:2:2::/bin:
sys:!:3:3::/usr/sys:
adm:!:4:4::/usr/adm:
uucp:!:5:5::/usr/spool/uucp
public:/usr/lib/uucp/uucico
guest:!:100:100::/usr/guest:
nobody:!:4294967294::4294967294::/:
lpd:!:104:9::/:

, , staff, .

groupids, - ( , /etc/group):

system:!:0:root
staff:!:1:
bin:!:2:root,bin
sys:!:3:root,bin,sys
adm:!:4:bin,adm
uucp:!:5:uucp
mail:!:6:
security:!:7:root
cron:!:8:root
printq:!:9:lpd
audit:!:10:root
ecs:!:28:
nobody:!:4294967294:nobody
usr:!:100:guest

( staff), , , . ( system, bin, security, cron) - . , , .

, , :

1. root;

2. ( security, system, printq, cron, adm, audit). security, // ;

3. .

security, root // .

:

: # cat /etc/security/user : 

user1: admin=true

PATH

PATH - , (). , PATH . . ( , Trusted Computing Base (TCB) PATH.)

, root ( ) . , /tmp ( ) - PATH su /tmp, su su .

PATH - , , . PATH ( ( )), . root root /.profile ( ) , root . root su root ( su) . ( "-" su , . , "-" su.)

, su root, ( PATH), . , :

1. ( root) C, , su. , root.

2. .

3. PATH , (home) .

4. - , , , root.

5. su, root. su, su ( PATH ) su .

6. su root, , .

7. , su root. , .

8. root root.

- " ", , su PATH.

, :

1. , root, , . PATH .

2. PATH , $HOME. ( ) AIX: PATH=/usr/bin:/etc:/usr/sbin:/usr/ucb:$HOME/bin:/usr/bin/X11:/sbin:. /usr AIX, . /etc . , . $HOME/bin. "" PATH .

(X11 /sbin), PATH : , (/$HOME/bin) . - , , ("") .

, , . AIX, AIX.

. Korn shell TMOUT, Borne shell TIMEOUT. , , , .

, - . , /etc/profile /etc/security/.profile: 

TMOUT=45
TIMEOUT=45
export TMOUT TIMEOUT

. (, ksh ), .

- . ( , ).

(Prompts)

, . Korn, $HOME/.profile:

PS1='$PWD $ ' (  )
export PS1

, "$". , , su root. "$" "#" su root.

, , su root, su "-".

, , , , .

( ), .

userid root

root. " " UNIX root, userid. , , , root. (, root) su root , userids.

root SMIT:

smit -Security and Users --Users
---Change / Show Characteristics of a Userid
* User NAME [root]
...
Another user can SU TO USER? [true]
...
User can LOGIN? [false] <--
User can LOGIN REMOTELY? [false] <--

root, /etc/passwd . root su telnet.

/var/adm/sulog ASCII , , , . pg, more cat. , .

/etc/utmp .

/var/adm/wtmp ( ). who file_name. who /etc/utmp.

last. , last root root, last reboot .

, who. /etc/security/failedlogin, , / . UNKNOWN.

"" (grpck, usrck, pwdch, sysck, tcbck) "" (lsuser lsgroup) root ( security).

grpck

grpck , , gid , . . -t : grpck -t ALL

, , Yes , userids, /etc/security/user .

usrck

usrck userid. -t . userid, . . , ( SMIT /etc/security/user).

usrck -t ALL userid root, . , root userid (. root userid).

pwdck

pwdck /etc/passwd /etc/security/passwd. - , /etc/security/passwd * () . : pwdck -t ALL pwdck , minalpha, minother, lastupdate.

lsgroup lsuser

SMIT, . , , : 

lsgroup -f ALL >> /tmp/check lsuser -f ALL >> /tmp/check

, , /tmp/check .

. , , root ( security).

lsuser root , : lsuser joe , joe. lsuser ALL, . .

tcbck

Trusted Computing Base (.Trusted Computing Base).

()

AIX, . () , . , .

(, root) . , , , . .

, , AIX, .

, ( ) .

: BIN STREAM.

- , . AIX ( ). AIX ( , , ). , , . , .

, . . , "" .

userid ( userids). , joe.

130 , AIX. . .

, . , - .

: , . .

, . , , , /etc/security/audit/objects.

:

Audit start - . - .

Audit shutdown - , BIN ( ) /audit/auditb, "" -.

Audit off - . , .

Audit on - audit off.

Audit query - .

/

(), .

r (read), w (write) x (execute) (), (group) (others). SUID (set UID), SGID (set GID) SVTX (sticky bit).

SUID, , , (UID) . SUID (shell scripts). SUID .

SGID, , , (GID) . SGID, , /.

r
w
x (cd) PATH
SUID UID -
SGID GID , ,
SVTX -

, , , ls :

AIX

- AIX. , :

, .
, , .
.
ACL.
.
- .
- , .
- .
, userid root.

, , -rwx ------- ( 700).

( ""), . , , suid ( suid root).

, suid- root. , suid- root .

( mount - nosuid. ( CD-ROM), () ).

Inodes Links

UNIX ( JFS AIX) , .

, .

UNIX - :

   --> inode -->

. inode, , , .

inode, . "" , /u/trial/data.

inode , "" .

: 

/u/trial/data --> /xyz/j/g34/check --> inode 317 --> data blocks /joes/stuff -->

, ( inode 317 ) "". "". ( UID GID) inode. . . ( , , inode .

inode.)

(.. - ). , /xxx /etc. , /xxx/my/data - /etc/my/data. , . .

( ) . (UID GID) inode. , . - , . root , chown, chgrp.

AIX, chown chgrp, . UNIX, .

, UID () GID ( ), userid groupid. userid ( UID) , , UID . userid . , , " " . , userid, UID, , UID.

, , .

, mv cp ( ). cp , . , .

mv , , . mv , . mv , , . ( ) ( ). .

()

( ) . "", " " "".

12 :

( );
, , ;
, ;
, , .

( ).

- ; .

. , , - , - .

ls

ls - . , . AIX li, ls.

, ls, - UNIX, , .

ls . , - :

ls -al
ls -ld
ls -l /some/file/name
ls -ld /some/directory/name

, ls -al, , "" ( ()).

, ls -ld, .

, ls -l /some/file/name, .

, ls -ld /s