ACFS Security & Encryption特性使用须知

使用ACFS Security & Encryption时应该注意的几个问题

 

1、 Encryption属性设置注意事项：

所有的Encryption设置类的操作必须在root或者文件owner用户下进行，不能在Security Administrator用户下进行

 

--init完之后，为/acfs3设置一个统一的Encryption算法，设置完成后加密处于关闭状态

root[C1] @ora12c1:/acfs3/dircd>acfsutil encr set -m /acfs3 -a AES -k 128

FS-level encryption parameters have been set to:

Algorithm (AES 128-bit), Key length (16 bytes)

 

root@ora12c1:/acfs3/dircd>acfsutil encr info -m /acfs3              

File system: /acfs3

        Encryption status: OFF

        Algorithm: AES 128-bits

        Key length: 16 bytes

 

--设置Encryption之前在/acfs3里已存在的文件不进行加密：

root@ora12c1:/acfs3/dircd>acfsutil encr info -m /acfs3 -r /acfs3    

 

 Path: /acfs3

        Encryption status: OFF

 Path: /acfs3/dircd

        Encryption status: OFF

 Path: /acfs3/dircd/dd

        Encryption status: OFF

 Path: /acfs3/dircd/dnsmasq.conf

        Encryption status: OFF

 Path: /acfs3/dircd/dracut.conf

        Encryption status: OFF

 Path: /acfs3/dircd/dirc

        Encryption status: OFF

 Path: /acfs3/dircd/dirc/cas.conf

        Encryption status: OFF

 Path: /acfs3/dircd/dirc/cron.deny

        Encryption status: OFF

 Path: /acfs3/dircd/dirc/crontab

        Encryption status: OFF

 

--设置Encryption之后在/acfs3里新建的文件也不进行加密：

root@ora12c1:/acfs3>touch cc

root@ora12c1:/acfs3>acfsutil encr info -m /acfs3 /acfs3/cc

 

 Path: /acfs3/cc

        Encryption status: OFF

 

--为/acfs3/dirb这个目录及下面的文件设置192bit不同于FS层的Encryption

root@ora12c1:/acfs3/dircd>acfsutil encr on -m /acfs3 -a AES -k 192 -r /acfs3/dirb

Using user-provided parameters: algorithm (AES), key length (24 bytes)

Encrypting (/acfs3/dirb)... done.

Encrypting (/acfs3/dirb/bashrc)... done.

 

root@ora12c1:/acfs3/dircd>acfsutil encr info -m /acfs3 -r /acfs3/dirb           

 

 Path: /acfs3/dirb

        Encryption status: ON

        Algorithm: AES 192-bits

        Key length: 24 bytes

 Path: /acfs3/dirb/bashrc

        Encryption status: ON

        Algorithm: AES 192-bits

        Key length: 24 bytes

 

--在[C2] /acfs3层面打开Encrytion开关，除/acfs3/dirb外的其它文件才开始使用了128bit的算法进行加密，/acfs3/dirb依然使用前一步设置的192bit加密算法

root@ora12c1:/acfs3>acfsutil encr on -m /acfs3           

Encryption has been enabled on (/acfs3)

Encrypting (/acfs3/dircd)... done.

Encrypting (/acfs3/dircd/dd)... done.

Encrypting (/acfs3/dircd/dnsmasq.conf)... done.

Encrypting (/acfs3/dircd/dracut.conf)... done.

Encrypting (/acfs3/dircd/dirc)... done.

Encrypting (/acfs3/dircd/dirc/cas.conf)... done.

Encrypting (/acfs3/dircd/dirc/cron.deny)... done.

Encrypting (/acfs3/dircd/dirc/crontab)... done.

Encrypting (/acfs3/dircd/dirc/crypttab)... done.

Encrypting (/acfs3/dircd/dirc/csh.cshrc)... done.

Encrypting (/acfs3/dircd/dirc/csh.login)... done.

Encrypting (/acfs3/dira)... done.

Encrypting (/acfs3/dira/adjtime)... done.

Encrypting (/acfs3/dira/aliases.db)... done.

Encrypting (/acfs3/dira/anacrontab)... done.

Encrypting (/acfs3/dira/anthy-conf)... done.

Encrypting (/acfs3/dira/asound.conf)... done.

Encrypting (/acfs3/dira/aliases)... done.

Encrypting (/acfs3/dira/autofs_ldap_auth.conf)... done.

Encrypting (/acfs3/dira/auto.master)... done.

Encrypting (/acfs3/dira/.auto.misc.swp)... done.

Encrypting (/acfs3/dira/.auto.misc.swx)... done.

Encrypting (/acfs3/dira/.auto.smb.swp)... done.

Encrypting (/acfs3/dira/.auto.smb.swx)... done.

Encrypting (/acfs3/dira/.abc.txt.swp)... done.

Encrypting (/acfs3/dira/.abc.txt.swx)... done.

Encrypting (/acfs3/dira/.auto.net.swp)... done.

Encrypting (/acfs3/dira/.auto.net.swx)... done.

Encrypting (/acfs3/dirb)... File is already encrypted

Encrypting (/acfs3/dirb/bashrc)... File is already encrypted

Encrypting (/acfs3/.Security)... done.

Open failed for /acfs3/.Security/backup

Encrypting (/acfs3/.Security/realm)... done.

Open failed for /acfs3/.Security/realm/logs

Encrypting (/acfs3/.Security/encryption)... done.

Encrypting (/acfs3/.Security/encryption/logs)... done.

Encrypting (/acfs3/.Security/encryption/logs/encr-ora12c2-727777111.log)... done.

Encrypting (/acfs3/.Security/encryption/logs/encr-ora12c1-727777111.log)... done.

Encrypting (/acfs3/enscript.cfg)... done.

Encrypting (/acfs3/environment)... done.

Encrypting (/acfs3/ethers)... done.

Encrypting (/acfs3/exports)... done.

Encrypting (/acfs3/cc)... done.

 

2、 文件或目录的是否加密的属性取决于其所在的域属性

--创建一个不加密的域

acfsadm1@ora12c1:/home/acfsadm1>acfsutil sec realm create encrealm1 -m /acfs3 -e off -o enable

 

acfsadm1@ora12c1:/home/acfsadm1>acfsutil sec info -m /acfs3 -n encrealm1     

ACFS Security administrator password:

Realm status: ENABLED

 

Users present in realm 'encrealm1' are as follows :

 

Groups present in realm 'encrealm1' are as follows :

 

Filters present in realm 'encrealm1' are as follows :

 

Encryption status : OFF

 

Realm description : ''

 

--/acfs3/dirb的加密属性

acfsadm1@ora12c1:/acfs3>acfsutil encr info -m /acfs3 -r /acfs3/dirb

 

 Path: /acfs3/dirb

        Encryption status: ON

        Algorithm: AES 192-bits

        Key length: 24 bytes

 Path: /acfs3/dirb/bashrc

        Encryption status: ON

        Algorithm: AES 192-bits

        Key length: 24 bytes

 

--将/acfs3/dirb加入域

acfsadm1@ora12c1:/acfs3>acfsutil sec realm add encrealm1 -m /acfs3 -f -r /acfs3/dirb

 

--再次查询/acfs3/dirb的加密属性，已经变成OFF

acfsadm1@ora12c1:/acfs3>acfsutil encr info -m /acfs3 -r /acfs3/dirb

 Path: /acfs3/dirb

        Encryption status: OFF

 Path: /acfs3/dirb/bashrc

        Encryption status: OFF

 

结论：某个文件或者目录的Encryption属性跟着域里的Encryption属性走

 

3、 利用ACFS Security控制访问用户与访问时间

案例1：仅oracle用户在8:00~21:00可以读取/acfs3/dira内容

--建立rule、ruleset，rule加入到ruleset

acfsadm1@ora12c1:/acfs3>acfsutil sec rule create sec_rule1_time -m /acfs3 -t time 08:00:00,21:00:00 -o ALLOW

ACFS Security administrator password:

acfsadm1@ora12c1:/acfs3>acfsutil sec info -m /acfs3 -l sec_rule1_time                                      

ACFS Security administrator password:

 

Information of rule 'sec_rule1_time' are as follows :

Type : TIME

Value : '08:00:00' - '21:00:00'

Option : ALLOW

 

acfsadm1@ora12c1:/acfs3>acfsutil sec rule create sec_rule1_user -m /acfs3 -t username oracle -o ALLOW          

ACFS Security administrator password:

acfsadm1@ora12c1:/acfs3>acfsutil sec info -m /acfs3 -l sec_rule1_user                               

ACFS Security administrator password:

 

Information of rule 'sec_rule1_user' are as follows :

Type : USERNAME

Value : oracle

Option : ALLOW

 

acfsadm1@ora12c1:/acfs3>acfsutil sec ruleset create sec_rule1_set -m /acfs3

 

acfsadm1@ora12c1:/acfs3>acfsutil sec ruleset edit sec_rule1_set -m /acfs3 -a sec_rule1_user,sec_rule1_time -o ALL_TRUE

 

acfsadm1@ora12c1:/acfs3>acfsutil sec info -m /acfs3 -s sec_rule1_set                                                                   

ACFS Security administrator password:

 

Rules present in rule set 'sec_rule1_set' are as follows :

        sec_rule1_user

        sec_rule1_time

Ruleset option : ALL TRUE

 

--创建域，将用户、目录等对象加入到域中

acfsadm1@ora12c1:/acfs3>acfsutil sec realm create secrealm1 -m /acfs3 -e on -a AES -k 256 -o enable

acfsadm1@ora12c1:/acfs3>acfsutil sec realm add secrealm1 -m /acfs3 -u oracle -l READ:sec_rule1_set -f -r /acfs3/dira

ACFS Security administrator password:

acfsadm1@ora12c1:/acfs3>acfsutil sec info -m /acfs3 -n secrealm1                                                   

ACFS Security administrator password:

Realm status: ENABLED

 

Users present in realm 'secrealm1' are as follows :

        oracle

 

Groups present in realm 'secrealm1' are as follows :

 

Filters present in realm 'secrealm1' are as follows :

        READ : sec_rule1_set

 

Encryption status : ON

Encryption algorithm : AES

Encryption key length : 256

 

Realm description : ''

 

--至此oracle用户具有读写相关的任何权限，因为添加的:/READ:sec_rule1_set 虽然只是允许读的权限，但也不存在其它拒绝写的:。

 

--Root用户由于没有加入到secrealm1，所以没有任何权限连列出目录的权限都没有

root@ora12c1:/acfs3/dira>ls -rlt

ls: cannot open directory .: Permission denied

 

--将Root用户加入到secrealm1后，也只有列出目录的权限，没有读取文件内容的权限，因为读取文件内容必须同时具备用户名为oracle(-t username oracle -o ALLOW)，时间段为8:00~21:00(-t time 08:00:00,21:00:00 -o ALLOW)两个条件(-a sec_rule1_user,sec_rule1_time -o ALL_TRUE)，ruleset中定义的ALL_TRUE正是指同时满足上述两个条件，所以root用户登陆后第一个条件总是不满足，所以就不适用于READ:sec_rule1_set，因此就无读的权限

acfsadm1@ora12c1:/acfs3>acfsutil sec realm add secrealm1 -m /acfs3 -u root -f -r /acfs3/dira

root@ora12c2:/acfs3/dira>ls -rlt

total 28

-rwxr-xr-x. 1 oracle oinstall   541 Feb  5 13:33 anacrontab

-rwxr-xr-x. 1 oracle oinstall 12288 Feb  5 13:33 aliases.db

-rwxr-xr-x. 1 oracle oinstall   245 Feb  5 13:33 anthy-conf

-rwxrwxrwx. 1 oracle oinstall  1521 Feb  5 13:33 aliases

-rwxr-xr-x. 1 oracle oinstall   232 Feb  5 13:33 autofs_ldap_auth.conf

-rw-------. 1 oracle oinstall     0 Feb  5 13:46 asound_c.swp

-rwxr-xr-x. 1 oracle oinstall     0 Feb  5 13:46 aliases.bak

-rwxr-xr-x. 1 oracle oinstall     0 Feb  5 13:49 asound.conf

root@ora12c2:/acfs3/dira>cat aliases.bak

cat: aliases.bak: Permission denied

 

案例2： oracle用户在8:00~21:00不能针对/acfs3/dire目录及下面的文件进行修改、删除、更改权限的操作，但可以读取其中内容，root用户对于/acfs3/dire具有所有权限

acfsutil sec rule create rule_dire_user -m /acfs3 -t username oracle -o DENY

acfsutil sec rule create rule_dire_time -m /acfs3 -t time 08:00:00,23:00:00 -o DENY

acfsutil sec ruleset create rule_dire_set -m /acfs3 -o ANY_TRUE

acfsutil sec ruleset edit rule_dire_set -m /acfs3 -a rule_dire_user,rule_dire_time -o ANY_TRUE

acfsutil sec realm create rule_dire_realm1 -m /acfs3 -e on -a AES -k 192 -o enable

acfsutil sec realm add rule_dire_realm1 -m /acfs3 -u oracle,root -l CHMOD:rule_dire_set,DELETEFILE:rule_dire_set,WRITE:rule_dire_set -f -r /acfs3/dire

acfsutil sec info -m /acfs3 -n rule_dire_realm1

Realm status: ENABLED

 

Users present in realm 'rule_dire_realm1' are as follows :

        root

        oracle

 

Groups present in realm 'rule_dire_realm1' are as follows :

 

Filters present in realm 'rule_dire_realm1' are as follows :

        WRITE : rule_dire_set

        DELETEFILE : rule_dire_set

        CHMOD : rule_dire_set

 

Encryption status : ON

Encryption algorithm : AES

Encryption key length : 192

 

Realm description : ''

 

acfsutil sec info -m /acfs3 -s rule_dire_set

ACFS Security administrator password:

 

Rules present in rule set 'rule_dire_set' are as follows :

        rule_dire_user

        rule_dire_time

Ruleset option : ANY TRUE

 

--oracle用户22:00登陆，测试权限

写权限：

su - oracle

cd /acfs3/dire

vi ethers

"ethers" [readonly] 1L, 28C

 

oracle@ora12c1:/acfs3/dire>ls -rlt

total 12

-rw-r--r--. 1 oracle oinstall    0 Feb 11 21:42 environment

-rw-r--r--. 1 oracle oinstall    0 Feb 11 21:42 exports

-rw-r--r--. 1 oracle oinstall 4843 Feb 11 22:03 enscript.cfg

-rw-r--r--. 1 oracle oinstall   28 Feb 11 22:03 ethers

 

删除文件的权限：

oracle@ora12c1:/acfs3/dire>rm ethers

rm: cannot remove `ethers': Permission denied

 

chmod权限：

oracle@ora12c1:/acfs3/dire>chmod 777 ethers

chmod: changing permissions of `ethers': Permission denied

 

chown权限并没有限制掉：

oracle@ora12c1:/acfs3/dire>chown oracle:dba ethers

oracle@ora12c1:/acfs3/dire>ls -rlt

total 12

-rw-r--r--. 1 oracle oinstall    0 Feb 11 21:42 environment

-rw-r--r--. 1 oracle oinstall    0 Feb 11 21:42 exports

-rw-r--r--. 1 oracle oinstall 4843 Feb 11 22:03 enscript.cfg

-rw-r--r--. 1 oracle dba        28 Feb 11 22:03 ethers

 

--root用户登陆后测试下来具有任何权限

 

结论：ACFS里的权限控制关键在于如何理解rule中的-o ALLOW/DENY，ruleset中的-o ALL_TRUE/ANY_TRUE：ruleset中的ALL_TRUE是指其包含的每一个Rule表达式的评估结果必须为TRUE，例如对于-t username oracle -o ALLOW来说，如果登陆的用户是oracle那么这个Rule表达式的结果就是TRUE；对于-t username oracle -o DENY来说，如果登陆的用户是oracle那么这个Rule表达式的结果就是FALSE；只有每一个表达式都为TRUE的情况下，才具有command_rule:ruleset所指定的权限，否则就没有该权限。ruleset中的ALL_TRUE是指其包含的所有Rule表达式中只要有一个评估值为TRUE，就能具有command_rule:ruleset所指定的权限。另外在ACFS里对于没有明确拒绝的权限或者说没有提及的权限，例如案例1中的oracle用户虽然只具有READ:sec_rule1_set权限，但因为没有明确拒绝其他权限所有oracle还是会拥有包括READ在内的所有权限

 

---

 [C1]只有先在FS层面先设置好统一的加密算法后，才能使用acfsutil  encr on设置具体目录的加密算法，否则会收到” acfsutil encr on: ACFS-10577: Encryption parameters not set.”报错

 [C2]如果在/acfs3层打开了Encryption开关就不能对其下的某个子目录单独关闭：

oracle@ora12c1:/acfs3>acfsutil encr off -m /acfs3 /acfs3/ethers

acfsutil encr off: ACFS-10415: File system level encryption is on, file level encryption operations are not allowed

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/53956/viewspace-1279999/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/53956/viewspace-1279999/