Implementing PS_CFG_HOME Security

The steps in this section describe techniques for applying more stringent access to a PeopleTools environment by restricting access to PS_CFG_HOME. If you intend to secure PS_CFG_HOME, it is assumed that you have also secured PS_HOME. Securing PS_CFG_HOME enables you to prevent malicious access to content and configuration files located in PS_CFG_HOME and in domain directories.

These steps describe a security implementation where you configure a user account(s) that can create and configure domains, and user account(s) for domain administrators, who can start and stop domains.

It is possible to limit the permissions to PS_CFG_HOME, such that the domain administrator account can:

• Create files and sub-directories in PS_SERVDIR.

  This is necessary for creating log files and temporary files. Tuxedo also requires read-write access to the domain directory.

• Read (but not change or delete) any existing configuration or template files in PS_SERVDIR.

  These files include .cfg, .ubb, .ubx, .val files, and so on.

Note:

To apply these permissions, you must do so after the domain has been configured but before it has been started.

Note:

Once these permissions have been implemented, only a user account with the appropriate privileges can reconfigure the domain.