Safeguard Administrator's Manual (G06.24+, H06.03+)
Table Of Contents
- What’s New in This Manual
- About This Manual
- 1 Introduction
- 2 Controlling User Access
- Introduction
- Using SAFECOM to Establish a Local User Community
- Using SAFECOM to Manage User Access to Your System
- Changing the Owner of a User Authentication Record
- Granting a User Temporary Access to Your System
- Requiring Users to Change Their Passwords
- Granting a Grace Period for Changing an Expired Password
- Forcing Immediate Expiration of a User’s Password
- Freezing a User's Ability to Access the System
- Specifying Auditing for a User ID
- Deleting Users
- Deleting Administrative Groups
- Using SAFECOM to Establish a Network of Users
- Using Safeguard With Nodes With Standard Security
- Identifying Network Users
- Granting a Network User Access to Objects on Your System
- Establishing a Community of Network Users
- Changes to the PAID During a User’s Session
- Additional Considerations for Aliases and Groups
- Additional Considerations for ACCESS with Network Specific Subject IDs
- Establishing Default Protection for a User's Disk Files
- Specifying a Default Command Interpreter for a User
- Establishing Guardian Defaults
- Assigning an Alias to a User
- 3 Managing User Groups
- 4 Securing Volumes and Devices
- 5 OBJECTTYPE Control
- 6 Managing Security Groups
- 7 Securing Terminals
- 8 Warning Mode
- 9 Configuration
- Safeguard Attributes
- Configuring User Authentication
- Configuring Password Control
- Configuring Device Control
- Configuring Process Control
- Configuring Disk-File Control
- Configuring Safeguard Auditing
- Configuring a Default Command Interpreter
- Configuring Communication With $CMON
- Configuring Logon Dialog
- Configuring Exclusive Access at Safeguard Terminals
- Configuring Warning Mode
- Configuring Persistence
- Configuring Attributes for Node Specific Subjects in ACLs
- 10 Installation and Management
- Safeguard Components
- Process Considerations for the SMP and SAFECOM
- Safeguard Subsystem Management Commands
- General Installation Procedure
- Installing the Safeguard Software
- Starting the SMP
- Converting to the Safeguard Subsystem
- Updating the Safeguard Software
- Guidelines for Securing the Safeguard Subsystem
- Monitoring the Safeguard Subsystem
- A SAFECOM Command Syntax
- Index
OBJECTTYPE Control
Safeguard Administrator’s Manual—523317-013
5-4
Controlling Users as an Object Type
2. Transfer ownership to user ID 12,8:
=ALTER OBJECTTYPE DEVICE, OWNER 12,8
3. Display the authorization record for OBJECTTYPE DEVICE:
=INFO OBJECTTYPE DEVICE
The display shows:
If you want the same group to control subdevice names, use the LIKE keyword when
adding OBJECTTYPE SUBDEVICE, thereby giving its authorization record the same
attributes as OBJECTTYPE DEVICE:
=ADD OBJECTTYPE SUBDEVICE, LIKE DEVICE
Now display the authorization record for OBJECTTYPE SUBDEVICE:
=INFO OBJECTTYPE SUBDEVICE
The authorization record has the same attributes as OBJECTTYPE DEVICE.
Now users whose administrative group is group 12 are the only users who can add
authorization records for device and subdevice names.
Controlling Users as an Object Type
Usually, only the super ID and group managers can add users to the system. If you
add OBJECTTYPE USER to the Safeguard database, however, you can create an
access control list that specifies who can add users. OBJECTTYPE USER also
controls who can add aliases and groups.
To add users, aliases, or groups, a user must have CREATE authority on the access
control list for OBJECTTYPE USER. To delete a user, alias, or group, a user must own
the individual protection record being deleted.
LAST-MODIFIED OWNER STATUS WARNING-MODE
OBJECTTYPE DEVICE
26JAN88, 11:00 12,8 THAWED OFF
012,* C
LAST-MODIFIED OWNER STATUS WARNING-MODE
OBJECTTYPE SUBDEVICE
26JAN88, 11:10 12,8 THAWED OFF
012,* C
Note. The super ID retains the ability to create protection records for an object type even if you
add an OBJECTTYPE protection record for that object type. If you want to deny this authority,
you must specifically deny it on the access control list for that object type. The super ID has all
access authorities for all system objects unless you specifically deny those authorities on an
object's access control list.