Configuring Network Security

There are several security considerations in HP VUE, determining:

Which users can unlock the display.
Which systems can NFS-mount local files.
Which systems can run applications using actions.
Which systems can access the local display.

To configure who can unlock the display

Use the Session Manager keys resource to specify who can unlock the display:
vuesession*keys: user[,user ...]

The default is the login user and root. Regardless of the value of the resource, root can always unlock the display.

Example. This resource specifies the users who can unlock the display.

   vuesession*keys:   kreta,ellen,dex,anna

To limit access to the local file system (NFS security)

Edit /etc/exports to provide NFS security. It contains a list of the remote systems that are permitted to NFS-mount local disk volumes:
file_system remote_host

Example. This entry in /etc/exports permits remote host hpthere to mount volume /doc.

   /doc   hpthere

To limit execution access to the system

Edit /etc/services, if necessary. The spc service must be listed.
Edit /var/adm/inetd.sec to include the hosts that should have access to the local SPCD. You should keep the access list as small as possible, since these services allow access to the machine by anyone connecting to the port. To add a complete network, include the network or subnet component of the address.

The Sub-Process Control Daemon (SPCD or softspcd) supports remote execution. When an action on a local host invokes an application on a remote host, the local HP VUE sends a message to the remote SPCD specifying the execution string for the application. For security reasons, the SPCD does not allow root to perform remote execution; root can't perform the file-based authentication over NFS.

By default, the mserve (Message Server) and spc (Sub-Process Control) services provided by HP VUE are restricted in /var/adm/inetd.sec to the host name of the system.




	NOTE: If you change the host name or internet address of the machine, make sure that `inetd.sec` contains the new host name.

Example. The following lines in /var/adm/inetd.sec specify the hosts permitted to access the local host's BMS: hostA, hostB, hostC, and all hosts on subnet 192.6.36.

   mserve  allow  hostA hostB hostC 192.6.36.*

   spc     allow  hostA hostB hostC 192.6.36.*

See Also.

The inetd.sec(4) man page contains additional information.

To limit remote access to a system's display

The mechanism for restricting access to the local display depends on whether the display connection is requested by an action or by some other mechanism.

Display access with actions. When an action executes a remote application, the application server is automatically given permission to connect to the local display (the xhost command is executed automatically).

To turn off automatic authorization, use the resource

   [client]*autoXhosting: false

Display access by other mechanisms. When a remote application is started in ways other than by actions, the remote host must have explicit permission to connect to the local display. There are two ways to provide (and limit) remote access to a local display:

Authorization by host name. This is the default authorization system used by HP VUE. It involves maintaining a list of all the remote hosts that have permission to use the local server to display clients. Authorization by host name is implemented by the /etc/X*.hosts file, where * is the display (for example, X0.hosts for display 0) or by the xhost command.
Authorization by user. This feature is provided by the R4 and R5 X servers.

Configuring Network Security

Technical documentation

» Table of Contents

» Glossary

» Index

To configure who can unlock the display

To limit access to the local file system (NFS security)

To limit execution access to the system

To limit remote access to a system's display