Bảng 9-5 mô tả một số lệnh bổ sung mà bạn có thể sử dụng với các hoạt động RBAC. Bảng 9-5 RBAC lệnh Mô tả Hiển thị ủy quyền cho người sử dụng. Làm cho một tập tin dbm. Xác định daemon tên bộ nhớ cache dịch vụ, đó là hữu ích cho bộ nhớ đệm user_attr, prof_attr, | 9 Additional Commands Table 9-5 describes some additional commands that you can use with RBAC operations. Table 9-5 RBAC Commands Command Description auths 1 Displays authorizations for a user. makedbm 1M Makes a dbm file. nscd 1M Identifies the name service cache daemon which is useful for caching the user_attr prof_attr and exec_attr databases. pam_roles 5 Identifies the role account management module for the Password Authentication Module PAM . Checks for authorization to assume role. pfexec 1 Identifies profile shells used by profile shells to execute commands with attributes specified in the exec_attr database 4 Identifies the configuration file for security policy. Lists granted authorizations. profiles 1 Displays profiles for a specified user. roles 1 Displays roles granted to a user. roleadd 1M Adds a role account on the system. roledel 1M Deletes a role s account from the system. rolemod 1M Modifies a role s account information on the system. useradd 1M Adds a user account on the system. The -R option assigns a role to a user s account. userdel 1M Deletes a user s login from the system. usermod 1M Modifies a user s account information on the system. Note - Reference http for further information on these commands. Role-Based Access Control 9-23 Copyright 2000 Sun Microsystems Inc. All Rights Reserved. Enterprise Services September 2000 Revision 9 Creating a User and a Role To create a user and a role perform the following steps 1. Create the role. roleadd -u 1000 -g 10 -d export home minime -m username passwd minime 2. Create the profile. vi etc security prof_attr Shut Able to shutdown the system 3. Add the profile to the role. rolemod -P Shut All username 4. Verify that the changes have been made in the etc user_attr file. more etc user_attr 5. Create the user. useradd -u 1001 -g 10 -d export home user1 -m -s bin ksh -R username user1 passwd user1 more etc passwd etc user_attr 6. Assign commands to the profile vi etc security .
