This chapter describes the options available to implement a security policy on Advanced Printing Software. Security options protect against unauthorized access to administrative functions and protect print jobs and print data from being accessed, copied, rerouted, or deleted by unauthorized users.
This chapter describes the following security features:
System Security (Section 4.1) Provides an overview of the security features and a description of how security works.
Authorization (Section 4.2) Describes the different privilege levels supported by the print system and describes the functions that can be performed by users possessing each privilege level.
Authentication by Access Control Lists (ACL) (Section 4.3) Describes what methods the print system uses to identify and authorize users making requests for print system services.
When a request is made to access a server, the request is in the form of a remote procedure call (RPC). The RPC request contains the UID of the user making the request. To identify and authenticate the user making the request, the print system checks the local password file and the NIS distributed password file to match the requester's UID with a valid UID. When this match is successful, the server accesses the server ACL to determine if the user is authorized to use the services that have been requested.
The following occurs when authorization is performed:
A match of the user name or group name of the requester and those in the ACL is attempted.
If the user name or group name match is successful, a match is made against the requested services and the privilege level granted to the user or group in the ACL.
If the user name or group name and the authorization of the requester
and the operation match those in the ACL, the operation is performed.
Users
who attempt to access services for which they have not been granted permission
are denied the requested services.
4.2 Authorization
Advanced Printing Software authorization is based on associating a user with a privilege level. There are three user levels defined for print system users:
End user A user that only prints through the print system. This is the least privileged user.
Operator A user that controls the printers in a facility. Operators have privileges that allow them to pause and resume printers and servers, requeue jobs, and shut down servers.
Administrator A user that has the operator privileges and those required to configure the system.
The print system also grants privileges to the local root account.
This
is the root account (UID 0) on the system where the print system server is
running.
The local root user has administrator privileges regardless of what
is defined in an ACL, and local root is the only user that has the authorization
required to start a server.
4.2.1 End User Operations
If the client for a print system request has been granted end user authorization, the client can perform the following operations:
Print on a logical printer that is associated with a server where the user has access rights.
Resubmit a job that the user owns, provided that it is being resubmitted through a server where the client has access rights.
Cancel jobs that the user owns.
List
(pdls)
operations on servers, queues,
and printers.
List
(pdls)
operations on jobs and documents
that the user owns.
Set or modify attributes on a job that the user owns.
List
(pdq)
job queue operations.
However,
the print system limits the attributes returned for jobs not belonging to
the user to those in the server
job-attributes-visible-to-all
list.
Print system operators perform day-to-day printer and job management functions. If a client for a print system operation has been granted operator authorization, the client can perform all of the end user operations as well as the following:
Remove print jobs from a
(pdclean)
a server
or queue.
Enable or disable a server, queue, or printer.
Pause or resume a server, queue, physical printer, or any job.
Promote a job.
Set or modify
xxx-ready
attributes.
Shut down a spooler or supervisor.
4.2.3 Administrator Operations
Some print system installations might not have operators, but instead might have only end users and administrators. In these cases, the administrators perform the day-to-day print and job management functions.
If a client for a print system request has been granted the administrator authorization, that client can perform the following operations:
Every operation that an operator is authorized to perform.
Set
(pdset)
all read and write attributes
of all objects.
Create servers, queues, printers, initial-value-jobs, and initial-value-documents.
Delete
(pddelete)
any object.
4.3 Authentication by Access Control Lists
The operations that end users, operators, and administrators are authorized to perform are controlled by Access Control Lists (ACLs). These authorizations and the ACLs control access only to server objects. ACLs do not limit a user's access to a particular printer.
ACLs are created by defining the
access-control-list
attribute for servers.
This attribute is multivalued and can be defined when
a server is created
(pdmakedb)
or at any time with the
pdset
command or through the GUI.
In most cases, you will not define
all your ACL attributes when you create a server but will add attributes after
the server has been created.
Table 4-1
describes the fields
of the
access-control-list
attribute.
Table 4-1: access-control-list Attribute Fields
Field | Description |
name | user name and host name (optional) |
name-type | Type of user: |
all-users | |
user | |
group | |
netgroup | |
privilege-level | Type of access level: |
end-user | |
operator | |
administrator |
Table 4-2
shows the properties of the name field of the
access-control-list
attribute and gives their meanings.
Table 4-2: Name Field Properties
Property | Description |
name=name | The named user from any client host in the domain. |
name=name@host | The named user from the saved name within the server's DNS domain. The server looks up the user in the password map file. |
Table 4-3
shows the properties of the name-type field
of the
access-control-list
attribute and gives their meanings.
Table 4-3: access-control-list Attribute Name-Type Field Properties
Property | Value of Name | User Affected |
name-type=user | name is a valid user name on the server | A user whose client hosts are members of the same DNS domain as the server. |
name-type=all-users | name has no value | All users on client hosts within the same DNS domain as the server. |
name=@ | All users in all DNS domains. | |
name=@domain | All users on clients in the specified DNS domain. | |
name=name@ or name=name | A user with user name name from client hosts in any DNS domain (not authenticated). | |
name-type=group | name is a valid group on the server | All users who are members of the named group. The server looks up the user name associated with the request in the group map or file (as specified in /etc/svc.conf) and verifies that the user is a member of that group. |
name-type=netgroup | A valid netgroup | All users who are members of the named netgroup. |
The following rules apply when a server accesses the ACL to verify authorization of a user:
If
name-type
is other than
all-users
, you must specify a value for name.
Also, the name of the user
(as determined by looking up the UID in a password file) making the request
must be:
An exact match to name, if
name-type=user
.
A member of the group, if
name-type=group
.
A member of the netgroup, if
name-type=netgroup
.
It is likely that you will use the netgroup value of name-type primarily for operator and administrator privilege levels, because it restricts specific users to specific hosts.
Note
You should not add root to an ACL, without specifying a host name (root@host_name), unless you want all root users from all remote systems in your network environment to have privileged access to servers.
You can create and modify ACLs from the command line or by using the
pdprintadmin
GUI.
This section describes how to create and manage
ACLs using both interfaces.
You can use the abbreviation, a-c-l for the
access-control-list
attribute.
Use the following command to add user
smith
as a printer operator for server
red_spl
:
# pdset -c server \ -x access-control-list+="{name=smith \ name-type=user privilege-level=operator}" \ red_spl
Use the following command line to remove operator
jones
from a supervisor ACL:
# pdset -c server \ -x a-c-l-="{name=jones name-type=user \ privilege-level=operator }" blue_sup
Perform the following steps to create or modify an ACL using the
pdprintadmin
GUI::
From the Tools menu, choose User Administration.
From the Components box, select a spooler or supervisor server.
From the Users box, select the
User Class
you want to add:
Administrator
,
Operator
,
or
Normal User
.
From the User Class, select
Everyone
or
Specified Users
.
If you selected
Specified Users
, click
Add to add a new entry, or click an existing entry to delete it.
The
Add New Entry
dialog box is displayed.
Select
User
if you are adding a single user, select
Group
if you are adding a group, or select
Netgroup
to add the name of a netgroup.
Enter the name of the user, group, or netgroup in the text field and click OK.