4    Managing Security

This chapter describes the options available to implement a security policy on Advanced Printing Software. Security options protect against unauthorized access to administrative functions and protect print jobs and print data from being accessed, copied, rerouted, or deleted by unauthorized users.

This chapter describes the following security features:

4.1    System Security

When a request is made to access a server, the request is in the form of a remote procedure call (RPC). The RPC request contains the UID of the user making the request. To identify and authenticate the user making the request, the print system checks the local password file and the NIS distributed password file to match the requester's UID with a valid UID. When this match is successful, the server accesses the server ACL to determine if the user is authorized to use the services that have been requested.

The following occurs when authorization is performed:

If the user name or group name and the authorization of the requester and the operation match those in the ACL, the operation is performed. Users who attempt to access services for which they have not been granted permission are denied the requested services.

4.2    Authorization

Advanced Printing Software authorization is based on associating a user with a privilege level. There are three user levels defined for print system users:

The print system also grants privileges to the local root account. This is the root account (UID 0) on the system where the print system server is running. The local root user has administrator privileges regardless of what is defined in an ACL, and local root is the only user that has the authorization required to start a server.

4.2.1    End User Operations

If the client for a print system request has been granted end user authorization, the client can perform the following operations:

4.2.2    Operator Operations

Print system operators perform day-to-day printer and job management functions. If a client for a print system operation has been granted operator authorization, the client can perform all of the end user operations as well as the following:

4.2.3    Administrator Operations

Some print system installations might not have operators, but instead might have only end users and administrators. In these cases, the administrators perform the day-to-day print and job management functions.

If a client for a print system request has been granted the administrator authorization, that client can perform the following operations:

4.3    Authentication by Access Control Lists

The operations that end users, operators, and administrators are authorized to perform are controlled by Access Control Lists (ACLs). These authorizations and the ACLs control access only to server objects. ACLs do not limit a user's access to a particular printer.

ACLs are created by defining the access-control-list attribute for servers. This attribute is multivalued and can be defined when a server is created (pdmakedb) or at any time with the pdset command or through the GUI. In most cases, you will not define all your ACL attributes when you create a server but will add attributes after the server has been created. Table 4-1 describes the fields of the access-control-list attribute.

Table 4-1:  access-control-list Attribute Fields

Field Description
name user name and host name (optional)
name-type Type of user:
  all-users
  user
  group
  netgroup
privilege-level Type of access level:
  end-user
  operator
  administrator

Table 4-2 shows the properties of the name field of the access-control-list attribute and gives their meanings.

Table 4-2:  Name Field Properties

Property Description
name=name The named user from any client host in the domain.
name=name@host The named user from the saved name within the server's DNS domain. The server looks up the user in the password map file.

Table 4-3 shows the properties of the name-type field of the access-control-list attribute and gives their meanings.

Table 4-3:  access-control-list Attribute Name-Type Field Properties

Property Value of Name User Affected
name-type=user name is a valid user name on the server A user whose client hosts are members of the same DNS domain as the server.
name-type=all-users name has no value All users on client hosts within the same DNS domain as the server.
  name=@ All users in all DNS domains.
  name=@domain All users on clients in the specified DNS domain.
  name=name@ or name=name A user with user name name from client hosts in any DNS domain (not authenticated).
name-type=group name is a valid group on the server All users who are members of the named group. The server looks up the user name associated with the request in the group map or file (as specified in /etc/svc.conf) and verifies that the user is a member of that group.
name-type=netgroup A valid netgroup All users who are members of the named netgroup.

The following rules apply when a server accesses the ACL to verify authorization of a user:

Note

You should not add root to an ACL, without specifying a host name (root@host_name), unless you want all root users from all remote systems in your network environment to have privileged access to servers.

4.3.1    Managing ACLs

You can create and modify ACLs from the command line or by using the pdprintadmin GUI. This section describes how to create and manage ACLs using both interfaces. You can use the abbreviation, a-c-l for the access-control-list attribute.

Perform the following steps to create or modify an ACL using the pdprintadmin GUI::

  1. From the Tools menu, choose User Administration.

  2. From the Components box, select a spooler or supervisor server.

  3. From the Users box, select the User Class you want to add: Administrator, Operator, or Normal User.

  4. From the User Class, select Everyone or Specified Users.

  5. If you selected Specified Users, click Add to add a new entry, or click an existing entry to delete it.

  6. The Add New Entry dialog box is displayed.

    Select User if you are adding a single user, select Group if you are adding a group, or select Netgroup to add the name of a netgroup.

  7. Enter the name of the user, group, or netgroup in the text field and click OK.