Securing PS_CFG_HOME on UNIX

You have these approaches when implementing a secure PS_CFG_HOME on UNIX:

Security Approach	Description
Use a root account, or use super user do (sudo), instead, to perform root-level operations with a non-root account:	This technique involves locking a user account’s access to a file from the root account.
Use two administrator user accounts:	The two administrator accounts approach involves using two user accounts that are members of the same group. This approach permits all users in the account in the group read access to the domain configuration. This approach works best if the number of users in the group is kept to a minimum. Because there are multiple users involved, it is necessary to override the default PS_CFG_HOME environment variable such that both users will see the same domains.

Security Approach

Description

Use a root account, or use super user do (sudo), instead, to perform root-level operations with a non-root account:

This technique involves locking a user account’s access to a file from the root account.

Use two administrator user accounts:

The two administrator accounts approach involves using two user accounts that are members of the same group.

This approach permits all users in the account in the group read access to the domain configuration.

This approach works best if the number of users in the group is kept to a minimum.

Because there are multiple users involved, it is necessary to override the default PS_CFG_HOME environment variable such that both users will see the same domains.

To set up a secure PS_CFG_HOME using sudo:

Create and configure the domain.

For this procedure, assume the user who does this is DomainAdmin.
Use sudo to restrict write access to the sensitive configuration files.

For example, with the sudo command include:
```
chmod 555 <filename>
```
In this case, only sudo can change the configuration files or restore write access to DomainAdmin.
Log in as DomainAdmin, and verify that none of the restricted files can be changed or deleted by the DomainAdmin session.
Start the domain as DomainAdmin.

To set up a secure PS_CFG_HOME using two administrator accounts:

Create and configure a domain.

For this procedure, assume the user who does this is DomainAdmin.
As the DomainAdmin user, change the permissions on the domain configuration to allow write access to only those files and directories needing to be written to by the user starting the domain.
Sign in as the DomainBootAdmin user, start PSADMIN, navigate to the Domain Administration menu, and re-configure the domain without making any changes.

This results in only the TUXCONFIG file being updated.
Star the domain as the DomainBootAdmin user.