Security considerations

You can control who can run BDD Shell and whether it can operate in a Kerberos-enabled environment.

The use of a custom Linux group and/or Kerberos support will enhance the security of BDD Shell.

Group access control for BDD Shell users

The person who installs BDD Shell will be given Owner permissions to it.

Optionally, you can create a Linux group to provide access control to the BDD Shell scripts. Users who are members of this group will be able to run BDD Shell. The group name can be any of your choosing. Note that for security purposes, it is recommended that you create a dedicated group with limited permissions.

After the group is created, you set the group name as the GROUP property in the bdd-shell.conf file, as in example for a group named "bdd-shell":

## OS group name whose member could run the BDD Shell. The group must exist before installation. (Optional)
GROUP=bdd-shell

As the property description notes, the group must exist before you can run the BDD Shell installer, as the installers validates the existence of the group.

Kerberos support

BDD Shell can run in a BDD cluster that has been enabled for Kerberos support. The BDD cluster must be enabled for Kerberos before you can the BDD Shell installer. The reason is that the BDD Shell installer picks up its Kerberos settings from the cluster's bdd.conf configuration file.

For information on enabling Kerberos at BDD installation time, see the Installation Guide. For information on enabling Kerberos after BDD has been installed, see the Administrator's Guide.