Mail*Link(r) SMTP RE>PowerBroker and root access
According to the very well documented literature package, PowerBroker
comprises three main programs: pbrun, pbmasterd, pblocald. Users submit their
requests from a submitting machine using pbrun. The master daemon, pbmasterd,
on a secure machine examines each request from pbrun and either accepts or
rejects it based on the information in the PowerBroker configuration file.
There can be multiple pbmasterd daemons running on the network to avoid
having a single point of failure. If the request is accepted, the pblocald on
the target execution machine runs the program, piping all input and output
back to the user. It appears that the secure machine acts as a proxy for root
access and records all keystrokes and output generated during a root session,
preventing tampering of the log by the user. Some of the other features of
PowerBroker are:
* provides a replay program to see the exact input and output as recorded by
the secure machine, and when each line of input was typed;
* a powerful Perl-like scripting language for the configuration file;
* encryption of the root session over the network to prevent sniffing;
* administration over a heterogenous network (Sun, HP, SGI, DEC, IBM, etc.).
Pricing was not available. They will be at USENIX LISA, booth 6, 9/21-22.
Contact them at:
Freedman Sharp and Associates Inc.
1011 First Street SW Suite 508
Calgary, Alberta, Canada T2R 1J2
(403)-264-4822
info @
fsa .
ca
>Date: 9/12/94 6:33 PM
>From: David Wolfskill
>I would expect that a person with root access could modify any of:
>* the audit trail iteslf;
>* the programs that control who has access to what;
>* the programs that create the audit trail; or
>* the files that control who has access to what uids
|
|
