[HR]

OpenVMS Guide to System Security

Contents (summary)

Part I Security Overview
Chapter 1 Understanding System Security
Chapter 2 OpenVMS Security Model
Part II Security for the User
Chapter 3 Using the System Responsibly
Chapter 4 Protecting Data
Chapter 5 Descriptions of Object Classes
Part III Security for the System Administrator
Chapter 6 Managing the System and Its Data
Chapter 7 Managing System Access
Chapter 8 Controlling Access to System Data and Resources
Chapter 9 Security Auditing
Chapter 10 System Security Breaches
Chapter 11 Securing a Cluster
Chapter 12 Security in a Network Environment
Chapter 13 Using Protected Subsystems
Appendix A Assigning Privileges
Appendix B Protection for OpenVMS VAX System Files
Appendix C Running an OpenVMS System in a C2 Environment
Appendix D Alarm Messages
Glossary
Index
Figures
Examples
Tables

Contents

Part I Security Overview
Chapter 1 Understanding System Security
- 1.1 Types of Computer Security Problems
- 1.2 Levels of Security Requirements
- 1.3 Building a Secure System Environment
Chapter 2 OpenVMS Security Model
- 2.1 Structure of a Secure Operating System
  - 2.1.1 Reference Monitor Concept
  - 2.1.2 How the Reference Monitor Enforces Security Rules
- 2.2 Implementation of the Reference Monitor
  - 2.2.1 Subjects
  - 2.2.2 Objects
  - 2.2.3 Authorization Database
  - 2.2.4 Audit Trail
  - 2.2.5 Reference Monitor
  - 2.2.6 Authorization Database Represented as an Access Matrix
- 2.3 Summary: System Security Design
Part II Security for the User
Chapter 3 Using the System Responsibly
- 3.1 Choosing a Password for Your Account
  - 3.1.1 Obtaining Your Initial Password
  - 3.1.2 Observing System Restrictions on Passwords
- 3.2 Knowing What Type of Password to Use
  - 3.2.1 Entering a System Password
  - 3.2.2 Entering a Secondary Password
- 3.3 Password Requirements for Different Types of Accounts
- 3.4 Types of Logins and Login Classes
- 3.5 Login Failures: When You Are Unable to Log In
- 3.6 Changing Your Password
  - 3.6.1 Selecting Your Own Password
  - 3.6.2 Using Generated Passwords
  - 3.6.3 Changing a Secondary Password
  - 3.6.4 Changing Your Password As You Log In
- 3.7 Password and Account Expiration Times
  - 3.7.1 Changing an Expired Password
  - 3.7.2 Renewing an Expired Account
- 3.8 Guidelines for Protecting Your Password
- 3.9 Network Security Considerations
  - 3.9.1 Protecting Information in Access Control Strings
  - 3.9.2 Using Proxy Login Accounts to Protect Passwords
- 3.10 Auditing Access to Your Account and Files
  - 3.10.1 Observing Your Last Login Time
  - 3.10.2 Adding Access Control Entries to Sensitive Files
  - 3.10.3 Asking Your Security Administrator to Enable Auditing
    - 3.10.3.1 Auditing File Access
    - 3.10.3.2 Additional Events to Audit
- 3.11 Logging Out Without Compromising System Security
  - 3.11.1 Clearing Your Terminal Screen
  - 3.11.2 Disposing of Hardcopy Output
  - 3.11.3 Removing Disconnected Processes
  - 3.11.4 Breaking the Connection to a Dialup Line
  - 3.11.5 Turning Off a Terminal
- 3.12 Checklist for Contributing to System Security
Chapter 4 Protecting Data
- 4.1 Contents of a User's Security Profile
  - 4.1.1 User Identification Code (UIC)
    - 4.1.1.1 Format of a UIC
    - 4.1.1.2 Guidelines for Creating a UIC
    - 4.1.1.3 How Your Process Acquires a UIC
  - 4.1.2 Rights Identifiers
    - 4.1.2.1 Types of Identifiers
    - 4.1.2.2 Process and System Rights Lists
    - 4.1.2.3 Displaying the Rights Identifiers of Your Process
    - 4.1.2.4 How Rights Identifiers Appear in the Audit Trail
  - 4.1.3 Privileges
- 4.2 Security Profile of Objects
  - 4.2.1 Definition of a Protected Object
  - 4.2.2 Contents of an Object's Profile
    - 4.2.2.1 Owner
    - 4.2.2.2 Protection Code
    - 4.2.2.3 Access Control List (ACL)
  - 4.2.3 Displaying a Security Profile
  - 4.2.4 Modifying a Security Profile
  - 4.2.5 Specifying an Object's Class
  - 4.2.6 Access Required to Modify a Profile
- 4.3 How the System Determines If a User Can Access a Protected Object
- 4.4 Controlling Access with ACLs
  - 4.4.1 Using Identifier Access Control Entries (ACEs)
  - 4.4.2 Granting Access to Particular Users
  - 4.4.3 Preventing Users from Accessing an Object
  - 4.4.4 Limiting Access to a Device
  - 4.4.5 Limiting Access to an Environment
  - 4.4.6 Ordering ACEs Within a List
  - 4.4.7 Establishing an Inheritance Scheme for Files
  - 4.4.8 Displaying ACLs
  - 4.4.9 Adding ACEs to an Existing ACL
  - 4.4.10 Deleting an ACL
  - 4.4.11 Deleting ACEs from an ACL
  - 4.4.12 Replacing Part of an ACL
  - 4.4.13 Restoring a File's Default ACL
  - 4.4.14 Copying an ACL
- 4.5 Controlling Access with Protection Codes
  - 4.5.1 Format of a Protection Code
  - 4.5.2 Types of Access in a Protection Code
  - 4.5.3 Processing a Protection Code
  - 4.5.4 Changing a Protection Code
  - 4.5.5 Enhancing Protection for Sensitive Objects
  - 4.5.6 Providing a Default Protection Code for a Directory Structure
  - 4.5.7 Restoring a File's Default Security Profile
- 4.6 Understanding Privileges and Control Access
- 4.7 Auditing Protected Objects
  - 4.7.1 Kinds of Events the System Audits
  - 4.7.2 Enabling Auditing for a Class of Objects
  - 4.7.3 Adding Security-Auditing ACEs
Chapter 5 Descriptions of Object Classes
- 5.1 Capabilities
  - 5.1.1 Naming Rules
  - 5.1.2 Types of Access
  - 5.1.3 Template Profile
  - 5.1.4 Kinds of Auditing Performed
  - 5.1.5 Permanence of the Object
- 5.2 Common Event Flag Clusters
  - 5.2.1 Naming Rules
  - 5.2.2 Types of Access
  - 5.2.3 Template Profile
  - 5.2.4 Privilege Requirements
  - 5.2.5 Kinds of Auditing Performed
  - 5.2.6 Permanence of the Object
- 5.3 Devices
  - 5.3.1 Naming Rules
  - 5.3.2 Types of Access
  - 5.3.3 Access Requirements for I/O Operations
  - 5.3.4 Template Profile
  - 5.3.5 Setting Up Profiles for New Devices
  - 5.3.6 Privilege Requirements
  - 5.3.7 Kinds of Auditing Performed
  - 5.3.8 Permanence of the Object
- 5.4 Files
  - 5.4.1 Naming Rules
  - 5.4.2 Types of Access
  - 5.4.3 Access Requirements
  - 5.4.4 Creation Requirements
  - 5.4.5 Profile Assignment
    - 5.4.5.1 Rules for Assigning Ownership
    - 5.4.5.2 Rules for Assigning a Protection Code and ACL
    - 5.4.5.3 Using the COPY and RENAME Commands
  - 5.4.6 Kinds of Auditing Performed
  - 5.4.7 Protecting Information When Disk Space Is Reassigned
    - 5.4.7.1 Overwriting Disk Blocks
    - 5.4.7.2 Setting a Highwater Mark
    - 5.4.7.3 Accessibility of Data in a File
  - 5.4.8 Suggestions for Optimizing File Security
- 5.5 Global Sections
  - 5.5.1 Naming Rules
  - 5.5.2 Types of Access
  - 5.5.3 Template Profile
  - 5.5.4 Privilege Requirements
  - 5.5.5 Kinds of Auditing Performed
  - 5.5.6 Permanence of the Object
- 5.6 Logical Name Tables
  - 5.6.1 Naming Rules
  - 5.6.2 Types of Access
  - 5.6.3 Template Profile
  - 5.6.4 Privilege Requirements
  - 5.6.5 Kinds of Auditing Performed
  - 5.6.6 Permanence of the Object
- 5.7 Queues
  - 5.7.1 Naming Rules
  - 5.7.2 Types of Access
  - 5.7.3 Template Profile
  - 5.7.4 Privilege Requirements
  - 5.7.5 Kinds of Auditing Performed
  - 5.7.6 Permanence of the Object
- 5.8 Resource Domains
  - 5.8.1 Naming Rules
  - 5.8.2 Types of Access
  - 5.8.3 Template Profile
  - 5.8.4 Privilege Requirements
  - 5.8.5 Kinds of Auditing Performed
  - 5.8.6 Permanence of the Object
- 5.9 Security Classes
  - 5.9.1 Naming Rules
  - 5.9.2 Types of Access
  - 5.9.3 Template Profile
  - 5.9.4 Kinds of Auditing Performed
  - 5.9.5 Permanence of the Object
- 5.10 Volumes
  - 5.10.1 Naming Rules
  - 5.10.2 Types of Access
  - 5.10.3 Template Profile
  - 5.10.4 Privilege Requirements
  - 5.10.5 Kinds of Auditing Performed
  - 5.10.6 Permanence of the Object
Part III Security for the System Administrator
Chapter 6 Managing the System and Its Data
- 6.1 Role of a Security Administrator
- 6.2 Site Security Policies
- 6.3 Tools for Setting Up a Secure System
- 6.4 Account Requirements for a Security Administrator
- 6.5 Training the New User
- 6.6 Logging a User's Session
- 6.7 Ongoing Tasks to Maintain a Secure System
Chapter 7 Managing System Access
- 7.1 Defining Times and Conditions for System Access
  - 7.1.1 Restricting Work Times
  - 7.1.2 Restricting Modes of Operation
  - 7.1.3 Restricting Account Duration
  - 7.1.4 Disabling Accounts
  - 7.1.5 Restricting Disk Volumes
  - 7.1.6 Marking Accounts for External Authentication
- 7.2 Assigning Appropriate Accounts to Users
  - 7.2.1 Types of System Accounts
    - 7.2.1.1 Interactive Account Example
    - 7.2.1.2 Limited-Account Example
  - 7.2.2 Privileged Accounts
  - 7.2.3 Interactive Accounts
  - 7.2.4 Captive Accounts
    - 7.2.4.1 Setting Up Captive Accounts
    - 7.2.4.2 Guidelines for Captive Command Procedures
  - 7.2.5 Restricted Accounts
  - 7.2.6 Automatic Login Accounts
  - 7.2.7 Guest Accounts
  - 7.2.8 Proxy Accounts
  - 7.2.9 Externally Authenticated Accounts
- 7.3 Using Passwords to Control System Access
  - 7.3.1 Types of Passwords
    - 7.3.1.1 Primary Passwords
    - 7.3.1.2 System Passwords
    - 7.3.1.3 Secondary Passwords
    - 7.3.1.4 Console Passwords
    - 7.3.1.5 Authentication Cards
  - 7.3.2 Enforcing Minimum Password Standards
    - 7.3.2.1 Expiring Passwords
    - 7.3.2.2 Enforcing Change of Expired Password
    - 7.3.2.3 Requiring a Minimum Password Length
    - 7.3.2.4 Generated Passwords
    - 7.3.2.5 Site Password Algorithms
  - 7.3.3 Screening New Passwords
    - 7.3.3.1 System Dictionary
    - 7.3.3.2 History Lists
    - 7.3.3.3 Site-Specific Filters
  - 7.3.4 Password Protection Checklist
- 7.4 Enabling External Authentication
  - 7.4.1 Overriding External Authentication
  - 7.4.2 Setting a New Password
  - 7.4.3 Case Sensitivity in Passwords and User Names
  - 7.4.4 User Name Mapping and Password Verification
  - 7.4.5 Password Synchronization
  - 7.4.6 Specifying the SYS$SINGLE_SIGNON Logical Name Bits
- 7.5 Controlling the Login Process
  - 7.5.1 Informational Display During Login
    - 7.5.1.1 Announcement Message
    - 7.5.1.2 Welcome Message
    - 7.5.1.3 Last Login Messages
    - 7.5.1.4 New Mail Announcements
  - 7.5.2 Limiting Disconnected Processes
  - 7.5.3 Providing Automatic Login
  - 7.5.4 Using the Secure Server
  - 7.5.5 Detecting Intruders
  - 7.5.6 Understanding the Intrusion Database
    - 7.5.6.1 How Intrusion Detection Works
    - 7.5.6.2 Setting the Exclusion Period
    - 7.5.6.3 System Parameters Controlling Login Attempts
  - 7.5.7 Security Server Process
Chapter 8 Controlling Access to System Data and Resources
- 8.1 Designing User Groups
  - 8.1.1 Example of UIC Group Design
  - 8.1.2 Limitations to UIC Group Design
- 8.2 Naming Individual Users in ACLs
- 8.3 Defining Sharing of Rights
- 8.4 Conditionalizing Identifiers for Different Users
- 8.5 Designing ACLs
- 8.6 Populating the Rights Database
  - 8.6.1 Displaying the Database
  - 8.6.2 Adding Identifiers
  - 8.6.3 Restoring the Rights Database
  - 8.6.4 Assigning Identifiers to Users
  - 8.6.5 Removing Holder Records
  - 8.6.6 Removing Identifiers
  - 8.6.7 Customizing Identifiers
    - 8.6.7.1 Dynamic Attribute
    - 8.6.7.2 Holder Hidden Attribute
    - 8.6.7.3 Name Hidden Attribute
    - 8.6.7.4 No Access Attribute
    - 8.6.7.5 Resource Attribute
    - 8.6.7.6 Subsystem Attribute
  - 8.6.8 Modifying a System or Process Rights List
- 8.7 Giving Users Privileges
  - 8.7.1 Categories of Privilege
  - 8.7.2 Suggested Privilege Allocations
  - 8.7.3 Limiting User Privileges
  - 8.7.4 Installing Images with Privilege
  - 8.7.5 Restricting Command Output
- 8.8 Setting Default Protection and Ownership
  - 8.8.1 Controlling File Access
    - 8.8.1.1 Adjusting Protection Defaults
    - 8.8.1.2 Setting Defaults for a Directory Owned by a Resource Identifier
      - 8.8.1.2.1 Setting Up the Resource Identifier
      - 8.8.1.2.2 Setting Up the Directory of a Resource Identifier
      - 8.8.1.2.3 Setting Up the ACL
  - 8.8.2 Setting Defaults for Objects Other Than Files
    - 8.8.2.1 Displaying Class Defaults
    - 8.8.2.2 Modifying Class Templates
- 8.9 Added Protection for System Data and Resources
  - 8.9.1 Precautions to Take when Installing New Software
    - 8.9.1.1 Potentially Harmful Programs
    - 8.9.1.2 Installing Programs with Privilege
  - 8.9.2 Protecting System Files
  - 8.9.3 Restricting DCL Command Usage
  - 8.9.4 Encrypting Files
  - 8.9.5 Protecting Disks
    - 8.9.5.1 Erasing Techniques
    - 8.9.5.2 Prevention Through Highwater Marking
    - 8.9.5.3 Summary of Prevention Techniques
  - 8.9.6 Protecting Backup Media
    - 8.9.6.1 Backing Up Disks
    - 8.9.6.2 Protecting a Backup Save Set
    - 8.9.6.3 Retrieving Files from Backup Save Sets
  - 8.9.7 Protecting Terminals
    - 8.9.7.1 Restricting Terminal Use
    - 8.9.7.2 Restricting Applications Terminals and Miscellaneous Devices
    - 8.9.7.3 Configuring Terminal Lines for Modems
Chapter 9 Security Auditing
- 9.1 Overview of the Auditing Process
- 9.2 Reporting Security-Relevant Events
  - 9.2.1 Ways to Generate Audit Information
    - 9.2.1.1 Auditing Categories of Activity
    - 9.2.1.2 Attaching a Security-Auditing ACE
    - 9.2.1.3 Modifying a User Authorization Record
  - 9.2.2 Kinds of System Activity the Operating System Can Report
    - 9.2.2.1 Suppression of Certain Privilege Audits
    - 9.2.2.2 Suppression of Certain Process Control Audits
  - 9.2.3 Sources of Event Information
- 9.3 Developing an Auditing Plan
- 9.4 Methods of Capturing Event Messages
  - 9.4.1 Using an Audit Log File
    - 9.4.1.1 Maintaining the File
    - 9.4.1.2 Moving the File from the System Disk
  - 9.4.2 Enabling a Terminal to Receive Alarms
  - 9.4.3 Secondary Destinations for Event Messages
    - 9.4.3.1 Using a Remote Log File
    - 9.4.3.2 Using a Listener Mailbox
- 9.5 Analyzing a Log File
  - 9.5.1 Recommended Procedure
  - 9.5.2 Invoking the Audit Analysis Utility
  - 9.5.3 Providing Report Specifications
  - 9.5.4 Using the Audit Analysis Utility Interactively
  - 9.5.5 Examining the Report
- 9.6 Managing the Auditing Subsystem
  - 9.6.1 Tasks Performed by the Audit Server
  - 9.6.2 Disabling and Reenabling Startup of the Audit Server
  - 9.6.3 Changing the Point in Startup When the Operating System Initiates Auditing
  - 9.6.4 Choosing the Number of Outstanding Messages That Trigger Process Suspension
    - 9.6.4.1 Controlling Message Flow
    - 9.6.4.2 Preventing Process Suspension
  - 9.6.5 Reacting to Insufficient Memory
  - 9.6.6 Maintaining the Accuracy of Message Time-Stamping
  - 9.6.7 Adjusting the Transfer of Messages to Disk
  - 9.6.8 Allocating Disk Space for the Audit Log File
  - 9.6.9 Error Handling in the Auditing Facility
    - 9.6.9.1 Disabling Disk Monitoring
    - 9.6.9.2 Losing the Link to a Remote Log File
Chapter 10 System Security Breaches
- 10.1 Forms of System Attacks
- 10.2 Indications of Trouble
  - 10.2.1 Reports from Users
  - 10.2.2 Monitoring the System
- 10.3 Routine System Surveillance
  - 10.3.1 System Accounting
  - 10.3.2 Security Auditing
- 10.4 Handling a Security Breach
  - 10.4.1 Unsuccessful Intrusion Attempts
    - 10.4.1.1 Detecting Intrusion Attempts
    - 10.4.1.2 Identifying the Perpetrator
    - 10.4.1.3 Preventing Intrusion Attempts
  - 10.4.2 Successful Intrusions
    - 10.4.2.1 Identifying the Successful Perpetrator
    - 10.4.2.2 Securing the System
    - 10.4.2.3 Repair After a Successful Intrusion
Chapter 11 Securing a Cluster
- 11.1 Overview of Clusters
- 11.2 Building a Common Environment
  - 11.2.1 Required Common System Files
  - 11.2.2 Recommended Common System Files
  - 11.2.3 Synchronizing Multiple Versions of Files
- 11.3 Synchronizing Authorization Data
- 11.4 Managing the Audit Log File
- 11.5 Protecting Objects
- 11.6 Storing Profiles and Auditing Information
- 11.7 Using the System Management Utility
- 11.8 Managing Cluster Membership
- 11.9 Using DECnet Between Cluster Nodes
Chapter 12 Security in a Network Environment
- 12.1 Managing Network Security
  - 12.1.1 Requirements for Achieving Security
  - 12.1.2 Auditing in the Network
- 12.2 Hierarchy of Access Controls
  - 12.2.1 Using Explicit Access Control
  - 12.2.2 Using Proxy Logins
  - 12.2.3 Using Default Application Accounts
- 12.3 Proxy Access Control
  - 12.3.1 Special Security Measures with Proxy Access
  - 12.3.2 Setting Up a Proxy Database
    - 12.3.2.1 Enabling and Disabling Incoming Proxy Access
    - 12.3.2.2 Removing Proxy Access
    - 12.3.2.3 Procedure for Creating a Proxy Account
  - 12.3.3 Example of a Proxy Account
- 12.4 Using DECnet Application (Object) Accounts
  - 12.4.1 Summary of Network Objects
  - 12.4.2 Configuring Network Objects Manually
  - 12.4.3 Removing Default DECnet Access to the System
  - 12.4.4 Setting Privilege Requirements for Remote Object Connections
- 12.5 Specifying Routing Initialization Passwords
  - 12.5.1 Establishing a Dynamic Asynchronous Connection
- 12.6 Sharing Files in a Network
  - 12.6.1 Using the Mail Utility
  - 12.6.2 Setting Up Accounts for Local and Remote Users
  - 12.6.3 Admitting Remote Users to Multiple Accounts
Chapter 13 Using Protected Subsystems
- 13.1 Advantages of Protected Subsystems
- 13.2 Applications for Protected Subsystems
- 13.3 How Protected Subsystems Work
- 13.4 Design Considerations
- 13.5 System Management Requirements
- 13.6 Building the Subsystem
- 13.7 Enabling Protected Subsystems on a Trusted Volume
- 13.8 Giving Users Access
- 13.9 Example of a Protected Subsystem
  - 13.9.1 Protecting the Top-Level Directory
  - 13.9.2 Protecting Subsystem Directories
  - 13.9.3 Protecting the Images and Data Files
  - 13.9.4 Protecting the Printer
  - 13.9.5 Command Procedure for Building the Subsystem
Appendix A Assigning Privileges
- A.1 ACNT Privilege (Devour)
- A.2 ALLSPOOL Privilege (Devour)
- A.3 ALTPRI Privilege (System)
- A.4 AUDIT Privilege (System)
- A.5 BUGCHK Privilege (Devour)
- A.6 BYPASS Privilege (All)
- A.7 CMEXEC Privilege (All)
- A.8 CMKRNL Privilege (All)
- A.9 DETACH Privilege (All)
- A.10 DIAGNOSE Privilege (Objects)
- A.11 DOWNGRADE Privilege (All)
- A.12 EXQUOTA Privilege (Devour)
- A.13 GROUP Privilege (Group)
- A.14 GRPNAM Privilege (Devour)
- A.15 GRPPRV Privilege (Group)
- A.16 IMPORT Privilege (Objects)
- A.17 LOG_IO Privilege (All)
- A.18 MOUNT Privilege (Normal)
- A.19 NETMBX Privilege (Normal)
- A.20 OPER Privilege (System)
- A.21 PFNMAP Privilege (All)
- A.22 PHY_IO Privilege (All)
- A.23 PRMCEB Privilege (Devour)
- A.24 PRMGBL Privilege (Devour)
- A.25 PRMMBX Privilege (Devour)
- A.26 PSWAPM Privilege (System)
- A.27 READALL Privilege (Objects)
- A.28 SECURITY Privilege (System)
- A.29 SETPRV Privilege (All)
- A.30 SHARE Privilege (All)
- A.31 SHMEM Privilege (Devour)
- A.32 SYSGBL Privilege (Files)
- A.33 SYSLCK Privilege (System)
- A.34 SYSNAM Privilege (All)
- A.35 SYSPRV Privilege (All)
- A.36 TMPMBX Privilege (Normal)
- A.37 UPGRADE Privilege (All)
- A.38 VOLPRO Privilege (Objects)
- A.39 WORLD Privilege (System)
Appendix B Protection for OpenVMS VAX System Files
- B.1 Standard Ownership and Protection
- B.2 Listing of OpenVMS VAX System Files
  - B.2.1 Files in Top-Level Directories
  - B.2.2 Files in DECW$DEFAULTS.SYSTEM and MOM$SYSTEM
  - B.2.3 Files in SYS$KEYMAP
  - B.2.4 Files in SYS$KEYMAP.DECW.SYSTEM
  - B.2.5 Files in SYS$LDR
  - B.2.6 Files in SYS$STARTUP and SYS$ERR
  - B.2.7 Files in SYSEXE
  - B.2.8 Files in SYSFONT and SYSFONT.DECW
  - B.2.9 Files in DECW.100DPI
  - B.2.10 Files in DECW.75DPI
  - B.2.11 Files in SYSFONT.DECW.COMMON
  - B.2.12 Files in SYSHLP
  - B.2.13 Files in SYSLIB
  - B.2.14 Files in SYSMGR
  - B.2.15 Files in SYSMSG
  - B.2.16 Files in SYSTEST
  - B.2.17 Files in SYSUPD
  - B.2.18 Files in VUE$LIBRARY
Appendix C Running an OpenVMS System in a C2 Environment
- C.1 Introduction to C2 Systems
  - C.1.1 Definition of the C2 Environment
  - C.1.2 Documentation
- C.2 Trusted Computing Base (TCB) for C2 Systems
  - C.2.1 Hardware in the TCB
  - C.2.2 Software in the TCB
  - C.2.3 Site-Specific Additions to the TCB
- C.3 Protecting Objects
- C.4 Protecting the TCB
  - C.4.1 Protecting Files
  - C.4.2 Privileges for Trusted Users
  - C.4.3 Privileges for Untrusted Users
  - C.4.4 Physical Security
- C.5 Configuring a C2 System
  - C.5.1 Keeping Individuals Accountable
  - C.5.2 Managing the Auditing Trail
  - C.5.3 Reusing Objects
  - C.5.4 Configuring Clusters
  - C.5.5 Starting Up and Operating the System
  - C.5.6 Forcing Immediate Reauthentication of a Specified Subject After a Change in Access Rights
- C.6 Checklist for Generating a C2 System
Appendix D Alarm Messages
Glossary
Index
Examples
- 3-1 Local Login Messages
- 4-1 Authorized Versus Default Process Privileges
- 6-1 Sample Security Administrator's Account
- 7-1 Creating a Typical Interactive User Account
- 7-2 Creating a Limited-Access Account
- 7-3 Sample Captive Procedure for Privileged Accounts
- 7-4 Sample Captive Command Procedure for Unprivileged Accounts
- 7-5 Intrusion Database Display
- 9-1 Sample Alarm Message
- 9-2 Audit Generated by an Object Access Event
- 9-3 Auditing Events for a Site with Moderate Security Requirements
- 9-4 Brief Audit Report
- 9-5 One Record from a Full Audit Report
- 9-6 Summary of Events in an Audit Log File
- 9-7 Identifying Suspicious Activity in the Audit Report
- 9-8 Scrutinizing a Suspicious Record
- 12-1 Sample Proxy Account
- 12-2 UAF Record for MAIL$SERVER Account
- 12-3 Sample Commands for a Dynamic Asynchronous Connection
- 12-4 Protected File Sharing in a Network
- 13-1 Subsystem Command Procedure
Figures
- 2-1 Reference Monitor
- 2-2 Authorization Access Matrix
- 2-3 Authorization Access Matrix with Labeled Cross-Points
- 4-1 Flowchart of Access Request Evaluation
- 8-1 Flowchart of File Creation
- 8-2 Security Class Object
- 9-1 Default Characteristics of the Audit Server
- 12-1 The Reference Monitor in a Network
- 12-2 A Typical Dynamic Asynchronous Connection
- 13-1 How Protected Subsystems Differ from Normal Access Control
- 13-2 Directory Structure of the Taylor Company's Subsystem
Tables
- 1-1 Event Tolerance as a Measure of Security Requirements
- 2-1 Objects Protected by Security Controls
- 2-2 Information Stored in the Authorization Database
- 2-3 Security Auditing Overview
- 3-1 Secure and Insecure Passwords
- 3-2 Types of Passwords
- 3-3 Reasons for Login Failure
- 4-1 Major Types of Rights Identifiers
- 4-2 Classes of Protected Objects
- 5-1 Access Requirements for Non-File-Oriented Devices
- 6-1 Example of a Site Security Policy
- 7-1 Authorize Qualifiers Controlling Login Times and Conditions
- 7-2 Login Qualifiers Not Allowed by Captive Accounts
- 7-3 Qualifiers Required to Define Captive Accounts
- 7-4 Defaults for Password History List
- 7-5 SYS$SINGLE_SIGNON Logical Name Bits
- 7-6 Intrusion Example
- 7-7 Parameters for Controlling Login Attempts
- 8-1 Employee Grouping by Department and Function
- 8-2 OpenVMS Privileges
- 8-3 Minimum Privileges for System Users
- 8-4 DCL Commands Used to Protect Files
- 9-1 Event Classes Audited by Default
- 9-2 Access Control Entries (ACEs) for Security Auditing
- 9-3 Kinds of Security Events the System Can Report
- 9-4 Events to Monitor Depending on a Site's Security Requirements
- 9-5 Characteristics of the Audit Log File
- 9-6 Qualifiers for the Audit Analysis Utility
- 9-7 Controlling the Flow of Audit Event Messages
- 10-1 System Files Benefiting from ACL-Based Auditing
- 11-1 System Files That Must Be Common in a Cluster
- 11-2 System Files Recommended to Be Common
- 11-3 Using Multiple Versions of Required Cluster Files
- 11-4 Fields in SYSUAF.DAT Requiring Synchronization
- 11-5 Summary of Object Behavior in a Cluster
- 12-1 AUTHORIZE Commands for Managing Network Proxy Access
- 12-2 Network Object Defaults
- B-1 Exceptions to Standard OpenVMS VAX System File Protection
- C-1 Software Not Included in the C2-Evaluated System
- C-2 Privileges for Untrusted Users

Next | [Home] | [Comments] | [Ordering info] | [Help]

[HR]

  6346PTOC.HTM
  OSSG Documentation
  22-NOV-1996 13:05:47.33

Copyright © Digital Equipment Corporation 1996. All Rights Reserved.