HP OpenVMS Systems

IMPERSONATE privilege, system security?

» close window

The Question is:

 
How can a user with the impersonate privilege use it to take over another
UIC ?
 
What are good security measures to prevent it's use or track attempts to
abuse the privilege ?
 
 

The Answer is :

 
  The topic of the IMPERSONATE (DETACH) privilege has been discussed here
  in Ask The Wizards before, please use the provided search engine, lest
  the Wizard tire of answering repeated questions and cause a questioner
  to impersonate a small, furry quadruped.
 
  The time-acknowledged method of preventing misuse of privilege(s) is to
  avoid granting excessive privileges -- the OpenVMS privilege construct
  is the means of controlling system access and operation, and there is no
  means of controlling the control mechanism.
 
  Tracking use of privileges involves the use of auditing.  This includes
  the use of privileges audits, as well as auditing access to the various
  security-relevent files and objects at your site.
 
  When considering auditing, bear in mind that solely auditing the "use of
  privilege" event is not sufficient, as the auditing logged under that
  event category only includes those events not otherwise audited.  The
  creation of a process, for example, will only show up as a "process
  creation" audit, not as a "use of privilege" event.
 
  Specific suggestions on appropriate system security are included in the
  OpenVMS system security manual, in the appendix covering configuring and
  operating in a NCSC Class C2 security environment.
 

  

     

     
answer written or last revised on ( 20-OCT-1998 )
     
» close window