AIX and CAPP Security

[rondebbs]

We are getting ready to install several new 5.3 tl 5 LPARs on 3 differnt p570 machines. Our security department has asked us to deploy them CAPP/EAL4+ compliant. I have never heard of CAPP until now - Control Access Protection Profile.

I have been reading some excepts from the AIX Security manual. Apparently during the install we will select "More Options" and then select "Enable CAPP and EAL4+ Technology". This will automatically set the "Trusted Computing Base" option to yes.

Has anyone out there done this? We will be running applications such as Filenet, Oracle, Informatica etc. Will CAPP create problems? Anything we should know about? Additional overhead?

Thanks - Brad

 

[khalidaaa]

Never tried that! But here is what IBM says about it:

http://publib.boulder.ibm.com/infoc...bm.aix.security/doc/security/capp_sys_cfg.htm

Regards,
Khalid

 

[RMGBELGIUM]

I've done that once before accidentally.This is sth you don't wanna do unless you know exactly which files are accessed when using commands.By defaults it resets all permissions in /usr/sbin and others to --------- .Meaning , for every command you want to issue, you will have to give permissions to dependent files / libraries ,and this can become really frustrating
So for Oracle,all sticky bits are removed with the tcbcheck if you don't be carefull, so you really really really have to know what you are doing.At the end , I reinstalled the machine, because it was much to frustrating...


rgds,


R.

 

[rondebbs]

It sounds like this could really add to the duration of my install/configurations tasks.