HP Hewlett Packard Printer Sentry User Manual

SENTRY

The Integra ted Sec urity System

Relea se 4

User Guide

Fitzgerald & Long

12341 E. Cornell Avenue, #18

Aurora, Colorado 80014-3323 USA

Phone: (303) 755-1102

FAX: (303) 755-1703

Table Of Contents

USING THIS GUIDE---------------------------------------------------------------------------------------- Intro - 1

USING THE SCREENS ------------------------------------------------------------------------------------ Intro - 3

INSTALLING SENTRY------------------------------------------------------------------------------------ Intro - 5

GETTING STARTED--------------------------------------------------------------------------------------- Intro - 8

INTRODUCING THE MAIN MENU ------------------------------------------------------------------Intro - 12

1. INTRODUCING THE DATABASE CREATION

AND VALIDATION MENU----------- 1 - 1

1.0 DATABASE CREATION AND VALUDATION MENU------------------------------------------- 1 - 2

1.1 UPLOAD USER AND GROUP PROFILES FROM UNIX----------------------------------------- 1 - 4

1.2 CREATE DATABASE FROM FILE SYSTEM ------------------------------------------------------ 1 - 6

1.3 VALIDATE THE USER PROFILE DATABASE ---------------------------------------------------- 1 - 7

2. INTRODUCING THE DATABASE

MAINTENANCE MENU-------------------------------- 2 - 1

2.0 DATABASE MAINTENANCE-------------------------------------------------------------------------- 2 - 2

2.1 SYSTEM PROFILE MAINTENANCE ---------------------------------------------------------------- 2 - 4

2.2 USER MAINTENANCE ---------------------------------------------------------------------------------2 - 10

2.3 GROUP MAINTENANCE-------------------------------------------------------------------------------2 - 18

2.4 FILE SYSTEM---------------------------------------------------------------------------------------------2 - 23

ACLs Maintenance-------------------------------------------------------------------------------------------2 - 28

More File Manager Views ----------------------------------------------------------------------------------2 - 31

2.5 COMMAND MAINTENANCE-------------------------------------------------------------------------2 - 34

2.6 USER ITEM PROTECTION MAINTENANCE-----------------------------------------------------2 - 38

3. INTRODUCING THE REPORTS MENU -------------------------------------------------------------- 3 - 1

3.0 REPORTS MENU------------------------------------------------------------------------------------------ 3 - 2

3.1 SYSTEM PROFILE REPORT--------------------------------------------------------------------------- 3 - 4

3.2 USER PROFILES ------------------------------------------------------------------------------------------ 3 - 9

3.3 GROUPS REPORT ---------------------------------------------------------------------------------------3 - 11

3.4 ACCOUNT PROTECTION REPORT-----------------------------------------------------------------3 - 13

3.5 COMMAND PROTECTION REPORT ---------------------------------------------------------------3 - 15

3.6 ACCESS VIOLATIONS REPORT---------------------------------------------------------------------3 - 17

4. INTRODUCING THE UTILITIES MENU ------------------------------------------------------------- 4 - 1

4.0 UTILITIES MENU----------------------------------------------------------------------------------------- 4 - 2

4.1 VOC PROTECTION SETUP ---------------------------------------------------------------------------- 4 - 4

4.2 PUGING THE VIOLATIONS LOG -------------------------------------------------------------------- 4 - 5

4.3 PASSWORD CREATION -------------------------------------------------------------------------------- 4 - 7

4.4 REBUILD CROSS REFERENCE FILES-------------------------------------------------------------4 - 10

4.5 UPDATE PROTECTED COMMANDS---------------------------------------------------------------4 - 11

APPENDIX 1 ---------------------------------------------------------------------------------------------Appendix - 1

SENTRY INTERNAL SUBROUTINES----------------------------------------------------------- Appendix - 1

Subroutine: SENTRY.ENCRYPT------------------------------------------------------------------ Appendix - 1

DATA ENCRYPTION------------------------------------------------------------------------------- Appendix - 2

Subroutine: SENTRY.USER.ITEM.CONTROL------------------------------------------------- Appendix - 3

Subroutine: SENTRY.VIOLATION.STAMP----------------------------------------------------- Appendix - 6

APPENDIX 2 ------------------------------------------------------------------------------------------ Appendix 2 - 1

SENTRY KEY BINDINGS ------------------------------------------------------------------------Appendix 2 - 1

SENTRY User’s Guide

Introduction - 1

USING THIS GUIDE

The SENTRY User's Guide is comprehensive in its descriptions of all of SENTRY's menus, data entry

screens and reports. The Guide follows the same structure as the SENTRY menu system.

There are four major sections in SENTRY. These are:

1. Database Creation and Validation

2. Database Maintenance

3. Reports

4. Utilities

Additionally, there is an introductory section and a number of appendices. The introduction includes an

overview of the User’s Guide, a description of conventions used throughout the SENTRY screens,

installation instructions and suggestions on getting started.

Note that each menu selection has a number to its left indicating the selection number from the Main Menu.

For example, the Database Maintenance Menu is preceded by the number "2", indicating that it is

the second selection from the Main Menu. The User Maintenance program documentation has the

section number 2.2 in it's title. This references the second program, User Maintenance, in the second

section, Database Maintenance.

The Guide uses several notation conventions for the sake of easy reading and conciseness. These include:

<RETURN> This figure indicates that the return key, sometimes called NEW LINE or ENTER, should

be pressed. This is one key stroke.

<ESC>

This figure is used to indicate the escape key. Most keyboards have a key labeled "ESC".

The use of the escape key is ALWAYS followed by <RETURN>. SENTRY uses this key

to allow an abort or escape from any program. All data remains as it were prior to the

aborted session. Please note that this function may be assigned to another key if desired.

See Appendix 2 for details on creating new key bindings.

" " (quotes) The SENTRY User's Guide frequently uses double quotation marks to set off the

characters you should enter. NEVER type the quotes!

TCL

Terminal Control Language. SENTRY will function equally well on any of the UNIX-

based database environments, including uniVerse, UniData and PI/open. Since each

environment uses its own naming conventions we have used the generic term “TCL” to

indicate the command prompt for whichever environment you are using. For UniData and

Fitzgerald & Long

Introduction - 2

SENTRY User’s Guide

PI/open the command prompt is indicated by a colon “:” while for uniVerse the prompt is

a greater-than sign “>”.

Fitzgerald & Long

SENTRY User’s Guide

Introduction - 3

USING THE SCREENS

SENTRY data entry screens feature some very helpful functions. These include "repaint", "backup",

"escape" (exit without update), “execute” and "help". The following paragraphs describe each function.

Repaint

^^ <RETURN> Enter a caret twice, followed by <RETURN>. The caret key is generally

located on the same key as the "6" (SHIFT 6). This is a total of three key strokes. The

screen will be repainted and the cursor will be repositioned to its original position. This is

very convenient when a system message causes a data entry screen to scroll.

Backup

Escape

^ <RETURN> Press the caret key followed by return (2 key strokes). This will cause the

cursor to backup one prompt in the data entry screen.

<ESC> <RETURN> Press the escape key followed by the return key (2 key strokes).

This feature allows you to exit any data entry program at any prompt. No data will be

changed.

Use this key to exit data entry screens when you have made changes and wish to cancel

your changes. To save changes you must enter "F" to file those changes.

XEQ

You may use TCL (Terminal Control Language) commands at any input prompt. Enter

"XEQ" followed by your command. For example:

XEQ LIST SENTRY.USERS WITH <

DEPARTMENT = “MIS” USER.NAME

HELP

Enter the word HELP at any input prompt in SENTRY. A HELP screen will be displayed

containing a brief explanation of the expected input and syntax where appropriate. Press

<RETURN> to exit the HELP screen.

Please note that these functions may be assigned to alternate keys if desired. See Appendix 2 for details

regarding creation of new key bindings

Fitzgerald & Long

Introduction - 4

SENTRY User’s Guide

Data Entry Conventions

Underscore/underline

When awaiting data, the cursor is positioned at the beginning of the field.

The field is delineated by underscores. A sentence describing the field is

displayed at the bottom of the screen. No data appearing on the

underscore is an indication that the field in the database is currently null.

Field numbers

Change a field

Each data entry screen and menu uses sequential numbers which appear at

the left of the field descriptions. To address a particular field, enter the

number associated with that field.

Having addressed the desired field via the field number, an underscore will

appear to the right of the current data and the cursor will be positioned on

the leftmost character of the data field. Type over the existing data to

change it. DO NOT space over existing data to delete characters which

your new entry does not cover. Simply <RETURN> when you have

entered the new data. The field will be repainted to display your entry.

Deleting a field

When you wish to delete the data in a field and make the field null,

address the field using the appropriate line number, then enter a space

followed by <RETURN>. A blank (null) field will be displayed.

Fitzgerald & Long

SENTRY User’s Guide

Introduction - 5

INSTALLING SENTRY

Installing the SENTRY software is very simple! Just follow these easy steps. If you encounter problems at

any point, please call us for additional assistance.

Before you begin, check your system to see if there is a possible conflict with the accounts we will be

loading. Do you have an account or user name called "sentry" or "sentry.practice"? If you have an account

or user ID which uses either of these names, DO NOT INSTALL SENTRY. Please call us for alternate

installation instructions. If you are in doubt as to the naming conventions on your computer, DO NOT

INSTALL SENTRY. Be safe, call us for assistance and instruction on installation. We want to help.

SENTRY will require approximately 5 to 10 MB of disk space in one filesystem on your computer. This is

an estimate. The actual size will vary depending on the number of files on your system and the cross

referencing for those files. Please discuss your disk space concerns with us. Check to see that this space is

available before beginning installation. You will NOT need to stop or start the system during installation

and your users may continue to use the computer while you are installing SENTRY.

1. Login to your system as the super-user (usually the user "root"). Change directories ("cd") to the

directory where you wish to place the SENTRY account. We suggest placing SENTRY in a top-level

directory (for example, the "/u1" or “/usr” directory). SENTRY may be placed on any local file system.

2. List the contents of the directory using "ls" or "ls -C". Make sure that this is the directory where you

wish to place SENTRY. Use "pwd" to verify your directory.

3. If SENTRY has been previously installed on your system, there may be an existing directory named

"sentry". Change the name of this existing directory to "sentry.old" by entering the command:

mv sentry sentry.old

Enter "ls -C" to verify that the name is changed.

4. Restore the contents of the tape using cpio. You will need to know the device file used to interface with

your tape drive. Ours, for example, is "/dev/rmt/0m". Enter this command:

cpio -icvBdum < /dev/xxx (replace xxx with your device file name)

The tape contains two accounts: sentry and sentry.practice. You must restore sentry; sentry.practice is

optional. It contains several demonstration items and files.

5. When the restore is complete, cd to the sentry directory and list the contents ("ls" or "ls -C").

Fitzgerald & Long

Introduction - 6

SENTRY User’s Guide

6. Notice a file named "install". This is a script which will perform the steps necessary to install the

SENTRY software. Execute the script by entering:

./install

7. Next type the command to enter your database environment (uv, udt, piopen). You should now see the

TCL prompt ">" or “:”.

If you see the UNIX message “…:not found” when you enter the command, it means that your PATH

variable is not setup to contain the path to the command directory of your database. Each database

environment has a directory named “bin” which contains its executable programs. The UNIX PATH

variable must contain the path to this directory in order for you to use the environment’s commands.

Depending upon the database system you have and where it is installed the path will look like one of these:

uniVerse

UniData

PI/open

/…/uv/bin

/…/udt/bin

/…/isys/bin

“…” implies that the actual path varies

according to where your database

account was installed.

The PATH variable may be set permanently by modifying the “.profile” file in your home directory to

include the appropriate path in the PATH assignment. The problem may be resolved temporarily (until you

logout) by entering these Bourne shell commands at the UNIX prompt:

PATH=$PATH:/…/…/bin

export PATH

Note that “/…/…/bin” must be replaced with the actual appropriate pathname!

8. Set the proper terminal type for the terminal you are using with the SET.TERM.TYPE command, (e.g.

SET.TERM.TYPE tvi925).

9. Now enter the command "SENTRY". You will see a copyright screen which identifies your company

and computer system. If there are discrepancies in the data on this screen, please contact us. SENTRY is

licensed only for use at the company and on the system described on the copyright screen.

10. Enter a carriage return. You will now see the SENTRY Menu on your screen (Figure 1).

Fitzgerald & Long

SENTRY User’s Guide

Introduction - 7

SENTRY

Main Menu

07 AUG 2000

1. Database Creation and Validation Menu

2. Database Maintenance Menu

3. Reports Menu

4. Utilities Menu

Please select one of the above:

Figure 1 - Main Menu

11. At this point you are ready to begin loading your data into the SENTRY database. This procedure is

described in the following section “Getting Started”.

Fitzgerald & Long

Introduction - 8

SENTRY User’s Guide

GETTING STARTED

This section describes how to invoke the SENTRY Main Menu. It also describes the copyright and the

validation screen which will be displayed as you enter SENTRY. Additionally, the first three steps for

loading the SENTRY database are presented.

< < S E N T R Y - Serial Number 00.08.70100 > >

This version of SENTRY has been prepared expressly for

Fitzgerald & Long, Inc.

12341 East Cornell Avenue

Aurora, Colorado

and may be used there only on the following computer system:

Hewlett-Packard 9000-E25, PI/Open Serial # 999999

Any other use is in violation of the license and is forbidden.

Fitzgerald & Long, Inc.

12341 East Cornell, # 18

Aurora, Colorado 80014 USA

Telephone: (303) 755-1102

Figure 2 - This is an example of the SENTRY copyright screen.

Having restored SENTRY from tape and installed the software, you are ready to proceed with this section.

SENTRY is installed as a directory named sentry; this directory is also setup as a standard database

account. To access SENTRY you must be “in” the sentry account – that is, sentry must be your present

working directory. To reach sentry from the UNIX prompt, use the UNIX “cd” command followed by

the command to invoke your database environment (e.g. “uv”, “udt” or “piopen”). To reach sentry

from TCL in another account use the TCL “LOGTO” command.

Since SENTRY is a security product, it won’t allow just any user to use it to modify your system! Only

users whose UNIX UID is 0 (zero) will be permitted to enter SENTRY. Users with the UID of 0 are

referred to as “super users” because they have the power to do nearly anything on the system. The

standard user “root” is an example of a “super user”. The passwords to super user logins should be

carefully protected!

Fitzgerald & Long

SENTRY User’s Guide

Introduction - 9

Our recommendation is that you create a userid called sentry with the UID of 0 (zero). This user will have

“sentry” as its “home” directory and will invoke the database on login. Suggestion: use SENTRY to

create this user while “getting started” with SENTRY.

At TCL, enter:

SENTRY

The SENTRY copyright screen (Figure 2) will be displayed. This screen reminds you that SENTRY is

protected by copyright law and is licensed for use to the company and computer system named on the

screen. Under no circumstances may you use the SENTRY software for any other company and/or

computer system than the one for which this copy of SENTRY was prepared, without the written

permission of Fitzgerald & Long, Inc.

The copyright screen awaits a <RETURN>.

Validating System Administrator authority.....

You must be super-user to use SENTRY!

Press <RETURN> to continue :

Figure 3 - This screen is displayed immediately after the copyright screen in the previous figure. You

will see the second line “You must be super user to use SENTRY” only if your user ID has a UID other

than 0 (zero).

NOTE: If another user is logged in as the System Administrator and attempts to use SENTRY, the

following message will be displayed.

SENTRY is currently being run by user n.

Fitzgerald & Long

Introduction - 10

SENTRY User’s Guide

This is a safety precaution. SENTRY is a very powerful tool and should only be used by the System

Administrator or his designee. SENTRY is designed to be a single user utility. Therefore, only one user at

a time is allowed into SENTRY.

The third SENTRY screen (Figure 3) informs you that SENTRY is validating that your user ID has a UID

of 0 (zero). If it does NOT, you will see the message:

“You must be a super-user to use SENTRY!”

The validation screen may flash by so quickly that you cannot read it because the test for UID = 0 is so

quick. Unless the validation fails, SENTRY will display the Main Menu.

The SENTRY Main Menu

There are four selections on the SENTRY Main Menu. These are:

1. Database Creation and Validation Menu

2. Database Maintenance Menu

3. Reports Menu

4. Utilities Menu

Choose selection one, Database Creation and Validation Menu. This selection presents another

menu which has three more choices. Each selection in each menu is documented thoroughly in the User

Guide. Simply look for the User Guide section that corresponds to the number of the menu selection. For

example, to get to the second selection of the Database Creation and Validation Menu you first entered “1”

from the Main Menu and then entered “2” from the next menu. In the User Guide you will find

documentation about this selection in section 1.2.

Read the appropriate section of the User Guide for each of the three selections in the Database Creation

and Validation Menu and then execute each one in turn. They perform the following tasks to setup your

SENTRY database:

1. Upload User and Group Profiles from UNIX - this program will read your UNIX passwd and

group files and create database records in SENTRY for all the users and groups which have been setup on

your system. The process will take just a few seconds.

2. Create Database from File System - this program scans the locals disks on your system and

builds cross reference information in SENTRY about the directories and files it finds. The cross reference

uses a sophisticated database structure known as a “balanced B-tree” - this will allow SENTRY to locate

objects on your disk nearly instantaneously! Because this is a complex task it will take longer, perhaps as

long as an hour or more. The appropriate section of the User Guide describes a technique for running this

program as a “phantom” or “background” task to avoid tying up your terminal.

3. Validate the User Profile Database - this program validates the logical integrity of the data you

have uploaded into SENTRY. It will print a report of any problems and inconsistencies it finds. If you

Fitzgerald & Long

SENTRY User’s Guide

Introduction - 11

wish to send the report to a specific printer, form or destination use the SETPTR command to set your

printer parameters before executing this selection.

After performing these steps your SENTRY database reflects the actual state of your system. You may

now use the Database Maintenance Menu to fix the inconsistencies reported by the validation program or

to modify users, groups and file permissions. You may also begin to protect database commands. The

Reports Menu will print a variety of useful reports which will allow you to view the data you have

collected. The Utilities Menu contains a number of tools which will occasionally be useful.

Complete documentation for each menu and selection in SENTRY is contained in the next sections of this

User Guide.

Fitzgerald & Long

Introduction - 12

SENTRY User’s Guide

INTRODUCING THE MAIN MENU

SENTRY'S Main Menu follows the copyright screen and the System Administrator validation screen. It is

the entry point into the four submenus. The four submenus are presented as selections 1 through 4 (Figure

4).

SENTRY

Main Menu

07 AUG 2000

1. Database Creation and Validation Menu

2. Database Maintenance Menu

3. Reports Menu

4. Utilities Menu

Please select one of the above: 1

Figure 4 - This is an example of SENTRY’s Main Menu which provides access to the four submenus and

divides SENTRY into four logical sections.

These four selections outline the four logical divisions of SENTRY. Each division is a collection of

programs which perform related tasks.

The documentation mirrors this organization: There are four major sections. Each section is introduced via

a figure of the Main Menu and a short description of the processes which may be performed from that

particular menu selection. Note that the section topic appears in bold print to amplify the Main Menu

selection used to invoke the submenu for that topic.

Each submenu is introduced in the same manner. Each selection on each submenu is documented through a

sample screen. A description of each field and its use is presented.

In using the menus please note that "on-line" help is available. At the menu selection prompt, enter

HELP <RETURN>

Then enter the number of the menu item for which you would like to receive help.

Fitzgerald & Long

SENTRY User’s Guide

Introduction - 13

The first selection, Database Creation and Validation Menu offers access to programs which upload

the information in the UNIX passwd and group files into SENTRY's database. Another program

transverses the disks, reading the permissions, owner and group for each file and directory and loading

cross reference information into SENTRY's database. Once the data are loaded, you should test the

consistency of the data by executing the validation program.

The second selection, Database Maintenance Menu, is the menu for all data entry programs. You

may create, delete, and modify users, groups and file permissions. You may also protect commands,

peruse files and directories and modify SENTRY system parameters.

This second submenu displays six selections. These are programs to maintain the system profile, user

profiles, groups, the file system, SENTRY's Command Protection and SENTRY's User Defined Item

Protection.

The third selection on SENTRY's Main Menu invokes the Reports Menu. This submenu provides

access to reports. These reports describe all aspects of the SENTRY database from the perspectives of

system, users, groups, permissions, access violations and SENTRY protected database commands.

The fourth selection on SENTRY's Main Menu is the Utilities Menu. This submenu provides a collection

of programs to perform such tasks as duplicating Command Protection in one account like that in another

account, purging the Violations Log, and rebuilding the cross reference files. You may also use a tool

which will generate new passwords for all or selected users. Yet another utility will update the VOC of a

protected account with the command protection setup through SENTRY, insuring consistency.

The following sections will describe each menu in detail. Each selection of each submenu is described with

examples of the screens and prompts available through these programs.

Fitzgerald & Long

SENTRY User’s Guide

Section 1 - 1

1. INTRODUCING THE DATABASE CREATION

AND VALIDATION MENU

The first selection of SENTRY's Main Menu is Database Creation and Validation. This menu provides

access to programs which will build SENTRY’s database from your existing user, group and file system

data.

SENTRY

Main Menu

07 AUG 2000

1. Database Creation and Validation Menu

2. Database Maintenance Menu

3. Reports Menu

4. Utilities Menu

Please select one of the above: 1

Figure 5 - Database Creation and Validation is the first selection on the Main Menu.

These programs provide a quick and easy way to document your existing system. Because all of the data

are loaded into SENTRY's database, comprehensive reports are available. Additionally, These programs

simplify most of the data entry tasks usually associated with setting up a new security system.

Complimentary to the programs which build the SENTRY database is a program to evaluate the

consistency of usage in groups, users, and permissions.

The three selections in the Database Creation and Validation Menu are the first three steps you

should take after installing SENTRY. The following sections provide detailed descriptions on how, when

and why these programs are used.

Fitzgerald & Long

Section 1 - 2

SENTRY User’s Guide

1.0 DATABASE CREATION AND VALUDATION MENU

This is the first submenu accessible from SENTRY's Main Menu. It is also the first selection you will

make after installing SENTRY. Through this menu, you will execute programs which load all the UNIX

passwd and group information on your system into SENTRY's database.

SENTRY

Database Creation and Validation Menu

07 AUG 2000

1. Upload User and Group Profiles from UNIX

2. Create Database from File System

3. Validate the User Profile Database

"<RETURN>" to return to previous menu

Please select one of the above:

Figure 6 - The Database Creation and Validation Menu provides access to three programs through

which you may create and validate the SENTRY database.

Three processes are available in this menu. These provide the capability of uploading the passwd and

group files into the SENTRY database, uploading file system information and validating the SENTRY

database.

The first selection, 1. Upload User and Group profiles from UNIX reads your existing UNIX

passwd and group files and writes the information into SENTRY's database. This is the first program you

will execute after SENTRY is installed.

The second selection, 2. Create Database from the File System transverses your local file systems

reading all information and creating B-trees to index this information. Note that no remote (NFS) disks are

read.

After SENTRY's database has been loaded with the passwd, group and file system data, selection 3.

Validate the User Profile Database is used to test the consistency of the data in SENTRY's database.

Tests include checks to insure that permissions do not reference users who do not exist in the passwd file or

groups which have no registered users. Following extensive validation, a report is produced which

documents the inconsistencies found.

The following sections present a detailed description of each program, the screens and the prompts.

Fitzgerald & Long

SENTRY User’s Guide

Section 1 - 3

Fitzgerald & Long

Section 1 - 4

SENTRY User’s Guide

1.1 UPLOAD USER AND GROUP PROFILES FROM UNIX

This program loads the data from the UNIX passwd and group files into the SENTRY database. Existing

data in the SENTRY database is checked and compared to that in these two files. The SENTRY database

is updated to reflect the same configuration as these files.

DB.LOAD

SENTRY Data Base Load

08/08/00

Enter "OK" to start the loading process or "<ESC>" to exit : OK

Loading user profiles.

Loading group information.

User and group information loaded.

Figure 7 - This is an example of the “SENTRY Database Load” screen. Enter “OK” to execute the

program.

This is the first program you will execute after SENTRY is installed. After the initial upload you will use

this program on a regular basis to insure that SENTRY is consistent with your UNIX files.

To invoke this program, enter 1. Database Creation and Validation Menu on SENTRY's Main

Menu. Then, enter 1. Upload User and Group Profiles from UNIX from the submenu. This

program will be invoked.

On first entering this program, only the prompt Enter 'OK' to start the loading process: is

displayed. Enter “OK” to begin or <ESC> to exit the program.

The loading process is performed in two steps. First, the information in the passwd file is read. Second,

the group file information is loaded into the SENTRY database. The screen will report the progress of the

program as it begins each step. Figure 7 is an example of this screen after the two steps have been

completed.

After loading your system information into SENTRY, you should use the SENTRY maintenance screens to

update, add or delete users and groups. You may still continue to use the UNIX utilities to manage users

and groups, but changes made will not be reflected in the SENTRY database until you perform the upload

again.

Fitzgerald & Long

SENTRY User’s Guide

Section 1 - 5

We recommend: Upload the passwd and group files into the SENTRY databases on a regular basis to

INSURE that SENTRY reflects an accurate view of your system. Because of the numerous file system

changes which occur daily in the normal course of operations, we recommend that you execute the program

which creates the file system view on a regular basis as well. These programs should be scheduled as

“over night” jobs at least once a week on systems with “normal” activity.

Because every site is unique, please discuss your system requirements with us if you are undecided about

the frequency with which you should be uploading (recreating) the SENTRY database.

The program that loads the UNIX passwd and group data into SENTRY can be run outside SENTRY’s

menu system, in “batch” mode. The program can be run at TCL, either directly or using the

“PHANTOM” command. This allows you to schedule the process via cron, BENTON or some other

utility. The command line to invoke the program is:

SENTRY.DB.LOAD (BATCH)

There is no difference in the actions performed whether the program is run from the menu for in “batch”

mode.

Fitzgerald & Long

Section 1 - 6

SENTRY User’s Guide

1.2 CREATE DATABASE FROM FILE SYSTEM

This section describes the program which create the B-trees to index your file system directories, files, file

owners and groups. On a system with a very large number of files, this process may take a number of

hours. This is a “read only” process. If does NOT interfere with your normal processing.

FILE.LOAD

Load SENTRY Filesystem Data Base

10/19/00

Enter "OK" to begin processing or "<ESC>" to exit : OK

Starting phantom to build sentry.output file...

Phantom task being performed by User 4097.

Output file is "SENT978972046C".

Reading sentry.output file and building BTREE records...

Path - /usr/bin/mediainit

Count - 185

Figure 8 - This is an example of the messages displayed by the program which creates the B-tree indices

of your file system.

We are very proud of SENTRY’s balanced B-tree system of indices. Through the use of B-trees, which

are ordered cross reference files, we are able to index your entire file system offering you a “file manager”

style window to view your file structure, permissions, file owners and groups in a very efficient manner

conserving not only CPU cycles but disk storage space as well.

On entering “OK” to start execution of this program, the old B-trees (if any) are cleared. Two processes

are started. One process reads the UNIX I-node tables and writes the information into a text file. A second

process reads in the text file and creates the B-tree entries.

Because this can be a very time consuming process and should be repeated on a regular basis, SENTRY

offers a “batch” processing option which may be scheduled through cron or executed through a phantom

process. This command is:

SENTRY.FILE.LOAD (BATCH)

To execute as a background job enter:

PHANTOM SENTRY.FILE.LOAD (BATCH)

You must be in the “sentry” directory to execute this job. Therefore, if you plan to use cron, the cron

process must “cd” into the “sentry” directory BEFORE executing the command.

Fitzgerald & Long

SENTRY User’s Guide

Section 1 - 7

1.3 VALIDATE THE USER PROFILE DATABASE

This program is used to check the consistency of the users, groups and permissions which have been loaded

into the SENTRY database via the first two programs described in this section. user IDs, groups, and their

usage in the file system are analyzed and inconsistencies are reported. For example, the validation report

might point out a file whose owner is not registered or a home pathname which does not exist on the

system.

VALIDATION

SENTRY Database Validation

08/16/00

Enter "OK" to start the validation or "<ESC>" to exit : OK

Do you want to print missing password messages? (Y/N) or <ESC> to exit: N

Validating user profiles

Validating groups

Validating file owners & groups

Validating COMMANDs

*** Problems found during validation ***

See Validation Report for Details

------------------------------ Database Invalid ------------------------------

Press <RETURN> to continue :

Figure 9 - This is an example of the messages displayed to the user during the execution of the validation

program.

Validating the data you have loaded from your passwd and group files and from the file system is the third

step which should be performed when you are first building the SENTRY database. Using this program

you will be able to locate and correct any inconsistencies in your user profiles and groups. Use this

program any time you wish to test for consistency of usage of user IDs, groups and file system protection.

We encourage you to use it EVERY TIME you upload data from the passwd and group files and when you

rebuild the B-tree files (which should be done on a regular basis).

Fitzgerald & Long

Section 1 - 8

SENTRY User’s Guide

This program will generate a printed report, using whatever printer setup is in effect at the time the

program is run. To modify the printer, destination or form, use the SETPTR command at the TCL prior to

running the program. Alternatively, the SENTRY XEQ function may be used to execute the SETPTR

command.

To execute this program, select 1. Database Creation and Validation Menu from the SENTRY Main

Menu. Next, select 3. Validate the User Profile Database from the Database Creation and Validation

Menu.

Enter “OK” to start the validation or “<ESC>“ to exit: - This is the first of two input prompts in

this program. If you enter “OK”, the program will continue. To exit at either prompt press <ESC> then

enter <RETURN>.

Do you want to print missing password messages?(Y/N) or <ESC> to exit:

Your answer to this prompt controls whether or not the validation program tells you about users who have

no passwords in the SENTRY database. If “Y” is entered the message

FATAL! User “USER.ID” does not have a password in the SENTRY database.

will print on the validation report.

When SENTRY retrieves the data from the passwd file, the password field is loaded into the SENTRY

database. SENTRY cannot read the password or decrypt it! Only passwords created from the User Profile

data entry screen, which are encrypted by SENTRY can be decrypted by SENTRY. Some system

administrators choose to setup and track all user passwords through SENTRY. Others choose to have

users manage their own passwords and not to maintain them in SENTRY. If you are not tracking user

passwords, the “missing password” messages will be of little use to you.

We suggest that you answer “N”o don’t print these messages unless you have created all passwords

through the User Profile data entry screen or through one of SENTRY’s password utilities.

Two types of errors are reported. These are called “FATAL” and “Warning”. “FATAL” errors are those

which we believe could possibly create a serious security issue or those which would lead to an operational

problem. The following is a list of errors which we have labeled as FATAL.

1. “User XXXXX not on the SENTRY.USERS file.” - The user name “XXXXX” was found in the

list of SENTRY users in the SENTRY.CONTROL file, but no record was found for this user in the

SENTRY.USERS file. This indicates an inconsistency in the SENTRY database; we suggest that the User

Profiles be uploaded from UNIX again (selection 1 in the Database Creation and Validation Menu.)

2. “User XXXXX does not have a password in the SENTRY database.”

The user

“XXXXX” has no password in SENTRY. This message will ONLY appear if you answered “Y” to the

prompt, “Do you want to print missing password messages?”. If you are tracking passwords

within SENTRY, this user should be assigned a password.

Fitzgerald & Long

SENTRY User’s Guide

Section 1 - 9

3. “Password for User XXXXX is less than N characters.” - The user “XXXXX” has a

password which is shorter than the minimum password length specified in the SENTRY System Profile

screen, which is N. This user’s password should be updated to conform to the minimum length restrictions

you have instituted.

4. “User XXXXX has no home directory.” - The user “XXXXX” has no home directory specified.

This would prevent the user from logging in, as UNIX would not know where to attach the user upon login.

The user should be updated and assigned a home directory.

5. “User XXXXX has an invalid home directory - /ZZZZZ.” - The user “XXXXX” has a home

directory in the SENTRY database of “/ZZZZZ”, but SENTRY cannot locate this directory on your file

system. Perhaps the directory was removed after it was assigned as the user’s home directory. The user

should be updated and assigned a valid home directory.

6. “Group XXXXX is not on the SENTRY.GROUPS file.” - A Group name was found in

SENTRY’s control list which does not exist in the SENTRY.GROUPS file. This indicates that one of

SENTRY’s database files is damaged and should be rebuilt. Upload the passwd and group files to fix this

problem.

7. “Command XXXXX not on the SENTRY.COMMANDS file.” - A VOC protection item was

found in SENTRY’s control list which does not exist in the SENTRY.COMMANDS file. This indicates

that one of SENTRY’s database files is damaged and should be rebuilt.

Errors beginning with the word “Warning” are informational - not serious database issues but situations

you should be aware of. The following is a list of those warnings.

1. “User XXXXX will default to “other” protection on all objects and commands.” - The

user “XXXXX” is not specifically mentioned, either by user ID or group membership, in the permissions

for any file system object or any VOC command protected by SENTRY. He will fall into the “other”

category for all protection on the system. This is NOT a problem, but could serve as an indication of a

user ID which is obsolete and no longer used.

2. “Group XXXXX is not used by any user.” - The group “XXXXX” is not being used by any user

on the system. Therefore, no users will receive their access permissions via this group. This may be a

group which is obsolete and should be removed or renamed.

3. “Group XXXXX is not used to protect any object or command.” - The group “XXXXX” is

not referenced in the permissions for any disk object or any VOC command. It may be assigned to users,

but is not used to protect anything. This might be an obsolete group which should be removed or renamed.

4. “Owner (UID) XXXXX on /ZZZZZ does not exist.” - The user ID number “XXXXX” is the

owner of a disk object whose path is “/ZZZZZ”. However, there is no user who is assigned this user ID

number. Possibly, there once was a user but he has been deleted. The owner for this disk object should be

replaced with a valid user on the system. Alternatively, a new or existing user could be assigned the same

user ID number (UID).

Fitzgerald & Long

Section 1 - 10

SENTRY User’s Guide

5. “Group (GID) XXXXX on /ZZZZZ does not exist.” - The group number “XXXXX” is the

registered group for a disk object whose path is “/ZZZZZ”. However, the group does not exist in

SENTRY. Possibly, the group once existed but has been deleted. The group for this disk object should be

replaced with a valid group on the system. Alternatively, a new or existing group could be assigned the

same group number (GID).

6. “Command /VVVVV does not have any groups or users assigned.” - The database

command whose path is “/VVVVV” has only “other” access rights assigned. No users or groups are

referenced in the command’s protection. This may be because only “other” access rights are needed;

everyone may have the same rights to the command. However, you should review the command protection

to be sure it is what you intend.

7. . “User (UID) XXXXX on command /VVVVV does not exist.” - The user ID number

“XXXXX” is referenced in the protection for a database command whose path is “/VVVVV”. However,

there is no user who is assigned this user ID number. Possibly, there once was a user but he has been

deleted. The user in this command’s protection should be replaced with a valid user on the system.

Alternatively, a new or existing user could be assigned the same user ID number (UID).

8. “Group (GID) XXXXX on command /VVVVV does not exist.” - The group number “XXXXX”

is referenced in the protection for a database command whose path is “/ZZZZZ”. However, the group does

not exist in SENTRY. Possibly, the group once existed but has been deleted. The group in this

command’s protection should be replaced with a valid group on the system. Alternatively, a new or

existing group could be assigned the same group number (GID).

As the validation program progresses four messages will appear. These are:

Validating user profiles

Validating groups

Validating file owners & groups

Validating COMMANDs

When these four sections of the validation program are completed SENTRY will display “Problems

found during validation, See Validation Report for Details.” The message “Database Invalid”

will appear at the bottom of the screen if FATAL errors are encountered. If only WARNINGS are found

the message displayed is “Questionable data found during validation.”

Fitzgerald & Long

SENTRY User’s Guide

Section 1 - 11

Fitzgerald & Long

SENTRY User’s Guide

Section 2 - 1

2. INTRODUCING THE DATABASE

MAINTENANCE MENU

The second selection on SENTRY's Main Menu is 2. Database Maintenance Menu. Through this

selection you may access data entry screens to create, delete and modify the system profile, user profiles,

groups, permissions, file ownership and Protection Command.

SENTRY

Main Menu

07 AUG 2000

1. Database Creation and Validation Menu

2. Database Maintenance Menu

3. Reports Menu

4. Utilities Menu

Please select one of the above: 2

Figure 10 - Database Maintenance is the second selection from SENTRY’s Main Menu.

Through using SENTRY to perform these tasks, you will enjoy data entry programs which validate

parameters such as home path and group names. Cross reference lists for groups and users will assist you

in creating just the users and groups you need without an inadvertent duplication.

These SENTRY maintenance programs assist you in cleaning up obsolete user IDs and groups that you no

longer want. Through the data entry programs you may quickly access an unwanted group and remove all

references to it. When SENTRY is used to remove a user ID, references to that ID are removed.

SENTRY provides the maintenance link between the file system permissions, the passwd file and the group

file.

Fitzgerald & Long

Section 2 - 2

SENTRY User’s Guide

2.0 DATABASE MAINTENANCE

This is the second sub-menu accessible from SENTRY’s Main Menu. It is the menu you will use to make

changes to the SENTRY database. You may create or modify users, groups and permissions through this

menu.

SENTRY

Maintenance Menu

07 AUG 2000

1. System Profile

2. User Profiles

3. Groups

4. File System

5. Database Commands

6. User Defined Items

"<RETURN>" to return to previous menu

Please select one of the above:

Figure 11 - This is the “Maintenance Menu” invoked from SENTRY’s Main Menu through selection 2.

The six selections on this menu invoke data entry programs used to update the SENTRY database, file

system permissions, the UNIX passwd and group files as well as SENTRY’s Database Command

Protection and User Defined Item Protection. Notice that we have used the word “Database” here.

Depending upon which database system you are using (INFORMATION, uniVerse, or UniData), your

actual SENTRY menu will replace the word “Database” with the name of the database which is in use on

your system.

1. System Profile. This selection provides a data entry screen with which you may review or modify the

system parameters. These parameters include password requirements, minimum and maximum lengths for

user IDs, group names, pathnames and commands.

2. User Profiles. user IDs may be created, deleted and modified through this selection. User profiles

include the user’s name, department, telephone, password life, UID, GID, home directory, supplementary

groups and login shell.

3. Groups. This selection offers you the ability to display the group GID, and the users associated with

the group plus you may add a description to the record to document your system.

Fitzgerald & Long

SENTRY User’s Guide

Section 2 - 3

4. File System. This entry allows you to scroll through your UNIX tree structure much like you do in

Window’s File Manager. From this selection you may request “file detail” information which is read from

the UNIX I-node. Included in this information is the last time the file was accessed and/or modified. In

this screen you may change the owner, the group and the permissions.

5. Database Commands. You may create, delete, modify and review the special permission-like

protection SENTRY offers for Verbs, Paragraphs, Sentences, Menus, and Procs through this entry. Users

and groups may be given rights to execute an item only from within a program and/or from the database

prompt. For example, this selection gives you the facility to restrict the use of “DELETE” at the database

prompt, but still make it available should your application software need to execute it from within a

program.

6. User Defined Items. This is a special SENTRY feature which allows you to define SENTRY

security objects. These objects may be accessed through subroutine calls to solve unique security problems

which may not be met through permissions and VOC item security facilities. For example, a personnel

report is needed by a secretary who is completing a group insurance report. This report also displays

salary information. A User Defined Item could be created so that the salary field displayed only asterisks

(*). The User Defined Item could discriminate by user ID or by group to determine when to print the salary

field. This would eliminate the need for ANOTHER report (which would increase the software Support

burden for the MIS staff).

The following sections describe the functionality of each selection, the prompts, the availability of cross

referencing and expected input. Examples of all screens are presented along with sample data.

Fitzgerald & Long

Section 2 - 4

SENTRY User’s Guide

2.1 SYSTEM PROFILE MAINTENANCE

This data entry program is used to display and change the system profile parameters. A number of these

parameters are system specific and must be set to reflect YOUR system’s limits. These parameters include

maximums and minimums for password length, user ID length, and group name length. During

installation, these parameters should be set appropriately for the limitations of your version of UNIX.

Generally, UNIX provides an “include” file called limits.h in which most of these maximums and

minimums are defined.

SYSTEM.MAINT

System Profile Maintenance

08/16/00

1. Null Passwords Allowed

2. Minimum Password Length

3. Maximum Password Length

: N

: 6

: 8

4. Enable Custom User Attributes

5. Password Format Mask

6. passwd File Order

: Y

: ALPHA,LC

: Y

7. group File Order

8. User & Group Case

: Y

: LC

: 6

: 8

: 1000

: /bin/sh

: 44

: 50

: 30

9. Minimum User ID Length

10. Maximum User ID Length

11. Maximum Group Name Length

12. Maximum UID Number

13. Maximum GID Number

14. Default Startup Command

15. Maximum Command Length

16. Maximum Startup Path Length

17. wtmp Valid Days Old

18. Punct for File Indexing

: .-_

Enter field number to modify, "C"ustom, "F"ile record or "<ESC>" to exit :

Figure 12 - This is an example of the SENTRY Profile Maintenance Data Entry Screen. The displayed

data are considered to be standard settings for most versions of UNIX.

On first entering this screen you will note that this set of “default” values will be displayed. Review the list

and change any parameter which is not appropriate for your version or UNIX or your environment. In the

following paragraphs we will describe each parameter and suggest a value.

To execute this program, select 2. Database Maintenance Menu from the Main Menu. Next, select 1.

System Profile from the secondary Maintenance Menu.

When this program is executed, the profile data will be read from the SENTRY database and displayed in

the appropriate fields. There are 18 items defined on this screen. A detailed description of the data entry

screen and prompts follows.

Fitzgerald & Long

SENTRY User’s Guide

Section 2 - 5

1. Null Passwords Allowed - The default of this field is “N”. When set to “N”o, each user must have

a password. If this field is set to “Y”es, you may create a user with a null password. For good security,

passwords should be mandatory. This field controls the data entry program for creating new users. When

creating a new user through the SENTRY data entry programs you will be REQUIRED to enter a

password for the user or allow SENTRY to generate one for you if this field is set to “N”. This is not a

UNIX parameter. It is used only by SENTRY. This field accepts the values “Y” or “N”.

2. Minimum Password Length - This is a UNIX parameter as well as one used by SENTRY when

new users are created. The minimum password length may be 0 (zero) to “your maximum value” in

length. However, most UNIX systems do not recognize more than 8 (eight) characters. More than 8 are

ignored. The recommended and default value for this field is 6. Using at least 6 characters decreases the

possibility that someone might guess a password or that a “break-in” might occur through computer

generated guesses. A six character password is also short enough so that a user is not overly taxed to

remember it (without writing it down). This field accepts only integer values 0 - 16.

3. Maximum Password Length - The UNIX limit is normally 8 characters. Your system may simply

ignore any characters after the eighth one. The default and recommended value for this field is 8. This

field accepts only integer values 0 - 16. The maximum value must be equal to or greater than the minimum

password length value.

4. Enable Custom User Attributes: - Because the various flavors of UNIX offer different options for

controlling passwords and login ids, Sentry manages these options via the “Custom User Attributes”

interface. When your version of Sentry was installed this parameter was set to “Y” if your system offered

additional options which most every system does.

5. Password Format Mask - This field is used by the User Profile data entry screen if you use

SENTRY’s generate new password option in the password field. If you plan to use this functionality you

may select a “mask” of either ALPHA or ALPHANUM which generates either alphabetic or alphanumeric

passwords. SENTRY will generate either a string of alphabetic characters such that the password is

alternating consonants and vowels for the length of the string defined by the Minimum Password Length

(selection 2 in this screen), or a string of characters beginning with an alphabetic character and containing

at least one numeric. If this field is set to null or ALPHA, only alphabetic characters will be used. If the

field is set to ALPHANUM, the generated password will contain at least one embedded numeric. The

default and recommended value is ALPHA which will generate a string of alphabetic characters, the length

defined by the Minimum Password Length field. If the minimum length field is 0 or null, a password of 6

characters will be used unless otherwise specified when the “G”enerate command is used in the password

field of the User Profile data entry screen.

You may also control the case of generated passwords by adding either “,LC” or “,UC” to the password

format field. The default is for generated passwords to be all lower case.

Many UNIX systems require that passwords must meet the following requirements:

Each password must have at least six characters. Only the first eight characters are significant.

Fitzgerald & Long

Section 2 - 6

SENTRY User’s Guide

Each password must contain at least two alphabetic characters and at least one numeric or special

character.

Each password must differ from the user name and from any reverse or circular shift of that name.

However, the System Administrator, (UID is zero) may create or change any password and those

passwords created by the superuser do not have to comply with password construction requirements.

6. passwd File Order - This field is used by the User Profile maintenance program. If the value of this

field is “Y”es, the names of the users are alphabetized in the UNIX passwd file. If you wish to maintain the

current order of the passwd file this field should be set to “N”o. The default and recommended value is

“Y”es. When alphabetized, the user “root” will be placed at the top of the passwd file.

7. group File Order - This field is used much the same as the passwd File Order field ( item 7). It is

used by the programs which create and modify users and groups. If the value of this field is “Y”es, the

names of the groups are alphabetized in the UNIX group file. If you wish to maintain the current order of

the group file this field should be set to “N”o. The default and recommended value is “Y”es.

8. User & Group Case - This field will contain LC (lower case), UC (upper case) or LIT (literal). It is

used by the programs which create and modify users and groups. When entering the name of a user or

group in User Profile or Groups screens the case of the name of the user or group will be set to the

appropriate one selected by this field regardless of the case used when entering the name. For example, if a

user name of TEST is entered in the User Profile screen, the case will be changed to “test” if this field is set

to “LC”. This parameter is intended to assist System Administrators who wish to be consistent in their

usage of case when creating users and groups. If you do not want SENTRY to alter the case for users and

groups set this field to “LIT” (literal). SENTRY will not alter the characters you have entered. The

default and recommended value for this field is “LC” (lower case).

9. Minimum user ID Length - This field contains a number defining the minimum number of characters

required for a user ID. A user ID must begin with an alphabetic character, contain no spaces and be

unique. This field is used to verify the length of the user ID in the User Profile data entry program. The

default and recommended value is 6.

10. Maximum user ID Length - This field contains a number defining the maximum number of

characters allowed for a user ID. Most UNIX systems allow up to 8 alphanumeric characters. This field is

used by the User Profile data entry screen to limit the length of user IDs created through SENTRY’s data

entry screens. The recommended and default value is 8.

11. Maximum Group Name Length - This value is used by the program to limit the number of

characters in group names. Group names are used only as a translation for the GID for such UNIX

utilities as “ls” and “id”. Some UNIX systems allow more than 8 character group names but we

recommend that your group names be no longer than 8 characters. The default and recommended value for

this field is 8.

12. Maximum UID Number - This field defines the largest number which may be used as a UID. This

maximum is a UNIX parameter. On some UNIX systems this number may be as large as 60,000.

Fitzgerald & Long

SENTRY User’s Guide

Section 2 - 7

However, we recommend using UIDs smaller than 5 digits simply to make them easier to read. The default

and recommended value for this field is 1000.

13. Maximum GID Number - This field defines the largest number which may be used as a GID. This

maximum is a UNIX parameter. On some UNIX systems this number may be as large as 60,000.

However, we recommend using GIDs smaller than 5 digits simply to make them easier to read. The default

and recommended value for this field is 1000.

14. Default Startup Command - This field contains the string executed at login for the user. It is

generally the “shell” command. The User Profile uses this field as a default value for creating a new user.

Simply returning past the startup command field will assign this value. The default value for this field is

/bin/sh. The recommended value for this field is the “normal” startup command for your average user.

15. Maximum Command Length - This field is a UNIX parameter and is generally documented in the

Administrator’s Guide for adding a user ID. The value of this field should be consistent with your version

of UNIX. On our system this maximum is set at 44 characters. Obviously a normal path to a UNIX shell

(such as /bin/sh) will be much smaller than 44 characters. The default value for this field is 44 characters.

The recommended value for this field is your system’s maximum value.

16. Maximum Startup Path Length - This field is a UNIX parameter and is generally documented in

the Administrator’s Guide for adding a user ID. The value of this field should be consistent with your

version of UNIX. On our system this maximum is set at 50 characters. This is the maximum number of

characters allowed in the pathname commonly referenced as the “home” directory. It is the directory into

which UNIX attaches the user at login. The default value for this field is 50 characters. The recommended

value for this field is the maximum number allowed by your version of UNIX.

17. wtmp Valid Days Old - SENTRY determines users last login date and time by using a UNIX

accounting file called “wtmp” which contains a log of user logins. The UNIX accounting feature which

updates “wtmp” may be turned on and off. SENTRY has no way of knowing if accounting is turned on or

not, so it looks for recent activity in the “wtmp” file. If no activity is found in the file during the last

number of days specified in this parameter, SENTRY assumes that accounting is turned off and doesn’t try

to determine a user’s last login date and time. Our default is set to 30 days.

18. Punct for File Indexing - SENTRY builds B-trees to provide rapid cross referencing into the file

system. For example, let’s imagine that you are looking for a file called “payroll.something”. You can’t

remember the “something”. In the File System screen you may enter “payroll” and SENTRY will search

the B-trees for all references to “payroll”. A list of pathnames to all files and directories whose name

contains the string “payroll” will be displayed. The cross referencing on the word “payroll” is dependent

upon the characters defined in this field. Special characters such as “.” and “-” or “_” are used in file or

directory names to make a compound name more readable. SENTRY’s B-trees will use the set of

characters defined here to break out the components of a compound name such as “payroll.ledger”. This

file would be indexed on the word “payroll” and on the word “ledger”. Care should be taken in selecting

these characters for cross referencing; limit them to those which are commonly used. The size of the B-

trees increase significantly as the number of characters in this list increases.

Fitzgerald & Long

Section 2 - 8

SENTRY User’s Guide

Note that the indexing occurs at the time that the “Create Database from File System” program is

run from the Database Creation and Validation Menu. If the punctuation characters used are changed, the

program must be rerun to put the new indexing into effect.

Enter field number to modify, “C”ustom, “F”ile record or “<ESC>“ to exit: - This is the primary

modifications prompt for this screen. To address any field simply type the associated number, 1 to 18,

followed by <RETURN>. That field will be cleared of any data which may currently be displayed there

and the program will await your input. To delete a field, enter a space followed by a <RETURN>. If the

screen is awaiting input at a prompt and you wish to backup to a previous prompt, enter “^” and

<RETURN> until you are positioned at the field you wish to modify. You may type “HELP” at any input

prompt. A HELP screen will be displayed. To exit HELP, simply enter <RETURN>.

To access the Custom User Default Maintenance screen, enter “C” <RETURN>. A new data entry screen

will be displayed where you may set the parameters which are used as the default in the User Maintenance

program. In the User Maintenance program you will be able to access these same parameter and change

them on a per user basis. To save time and provide consistency in setting parameters for users, we

recommend you set the defaults to those most commonly used.

If you have made changes to the data in this screen remember to enter “F” to file or your changes will be

discarded. To leave this screen without filing any changes enter <ESC> followed by <RETURN>.

Custom User Default Maintenance – SUN

The SUN operating system offers five options for managing passwords. Our “Custom User Default”

program allows you to set these parameters if desired. These defaults are used when you create users in the

User Maintenance program. By setting up defaults you may save time during the data entry necessary to

create a new user plus you will be aided in creating consistency in the password management for all users if

you desire.

CUSTOM.USER

Custom User Default Maintenance

User : DEFAULT

08/16/00

1: Minimum password change (days)

2: Maximum password change (days)

3: Password change warning (days)

4: Maximum inactive time (days)

5: Expiration date (MM/DD/YY)

: 5

: 90

: 5

: 21

Enter field number, "F"ile or "<ESC>" to exit :

Figure 13 - This is an example of the ”Custom User Default Maintenance” data entry screen.

To execute this program, enter “1” System Profile Maintenance from the Main Sentry menu, after recalling

an exiting user or entering a new user you may enter “C” at the bottom prompt. Entering “C” invokes this

program. The following paragraphs describe the five available options.

Fitzgerald & Long

SENTRY User’s Guide

Section 2 - 9

1. Minimum password change (days): Enter the number of days before a user is allowed to change

his existing password. For example, if UNIX has just expired a users password and the user enters a new

one, you can use this parameter to prevent the user from resetting his password to the old one for the

number of days you specify. The idea is that if the user is forced to keep the new password for several

days, he will not change it back to the older one. We recommend 5 days.

2. Maximum password change (days): Enter the number of days before a user is forced by UNIX

to change his password. Many companies use 90 days as a standard. This would allow a user to keep a

new password for 90 days before he was forced by UNIX to enter a new password. This is 90 calendar

days.

3. Password change warning (days): Enter the number of days before a new password is required

that you would like UNIX to warn the user that his password is about to expire. We recommend 5 days.

4. Maximum inactive time (days): This field is used to protect inactive logins. For example, if a user

did not use his login id for a specified number of days such as 21, UNIX would automatically expire the

password. At that time the system administrator will have to re-instate the password to allow logins for

that user id. Enter the number of days the login can remain active before it is expired. We chose 21

because we expect vacations and sick leave to be less than three weeks. Any event greater than three weeks

would be a special circumstance and we would deal with that on an individual basis.

5. Expiration date (MM/DD/YY): There may be login ids which are created for short term use such as

for auditors or seasonal employees. You may wish to enter a date when the login id will expire for these

types of users. Because this is the default screen, setting a default expiration date is not very logically

unless the entire user system is to be drastically changed on a certain date.

The last line of the screen is:

Enter field number, “F”ile or “<ESC>” to exit:

If you wish to modify any of the fields, 1 through 5, enter the number of the field you wish to change

followed by <ENTER>. After you have made changes enter “F” to file/save your changes. To exit the

program without saving any changes, enter <ESC>. You will be returned to the “System Profile

Maintenance screen.

Fitzgerald & Long

Section 2 - 10

SENTRY User’s Guide

2.2 USER MAINTENANCE

This data entry program is used to display, change, and delete user IDs, including documentation for the

user, UID, GID, home directory, and initial startup command. Additionally, all supplementary groups are

displayed in this screen. Supplementary groups may be added and deleted from the user’s profile. Cross

referencing is available to list existing users and their UIDs, existing groups and their GIDs, and home

directories in use.

USER.MAINT

User Maintenance

08/08/00

user ID : peggy

Last Login : Mon Jun 20 15:05

1. User Name

: Long Peggy

: Office 123

: 303/755-1102

: ****************

: 0 (peggy,root)

: 20 (users)

2. Department

3. Telephone

4. Password

5. UID

6. GID

7. Home Directory

8. Command

9. Groups

: /users/peggy

: /bin/sh

: 01> 20 (users)

Enter field number, “C”ustom, "F"ile, "DEL"ete or "<ESC>" to exit :

Figure 14 - This is an example of the ”User Maintenance” data entry screen which is invoked via

Selection 2 on the “Database Maintenance Menu”.

This program is used to create, delete and modify a user’s profile. It is also a very handy utility to use to

review the supplementary groups in use by a particular user. Additionally, you may access this data by

entering the user’s ID or the user’s name through the cross reference facility. For large systems, the user’s

name, department, and telephone number aids in monitoring computer usage. For example, if you observe

that a user with the ID of “usr545” is performing a very CPU intensive task, you may be interested in

learning which program he is running. Using this screen you may retrieve the data record for this user, see

that he is in the Payroll department, get his name and telephone number and call to inquire what process he

is executing.

To execute this program, select 2. Database Maintenance Menu from SENTRY’s Main Menu; then, select

2. User Maintenance from the Database Maintenance Menu. The User Maintenance program will be

invoked.

A detailed description of the data entry screen (Figure 15) and prompts follows.

When first invoked, no data will be displayed in this screen. You will be prompted to enter the user ID

which you wish displayed. For a list of all users defined on the system, enter “@”. To search the

Fitzgerald & Long

SENTRY User’s Guide

Section 2 - 11

SENTRY database using the user’s name, enter “@” followed by the first or last name of the user. For

example, if you wanted to search for user IDs for Peggy Long, you could enter “@long”. If there were

more than one “long” or if Peggy had more than one ID, a list would be displayed from which you could

choose the appropriate user. When there are many users with common names, you may enter both first and

last names to narrow the search; for example, “tom smith” or “smith tom”. Note that this cross reference

capability is dependent upon your putting the names of new users in a consistent format. Before setting up

a new user ID, you should always search for old IDs to prevent setting up unnecessary or unwanted IDs.

To create a new user ID, enter the ID at the user ID prompt. Use an ID of a length that conforms to the

maximum and minimum user ID parameters set in the System Profile screen (the first menu item described

in this section). Most UNIX systems use user IDs which are no greater than 8 characters in length and use

only letters and numbers.

Use a consistent naming convention to assist the System Administrator. A preferred scheme at many sites

is to use the person’s first initial and last name (e.g. p.long or the reverse long.p). This is particularly

helpful in routing printouts to the proper person. Note that the preferred case is lower. The controlling

case parameter is set in the System Profile screen.

1. User Name - This field is intended to identify the user. For reporting purposes, it is best to enter the

last name, first name, and middle initial. For user IDs which are not related to a specific user such as

“payroll”, you may wish to enter a descriptive phrase such as “Special ID for check runs”. This field

provides cross referencing for the user ID field.

2. Department - Enter the department name or some meaningful descriptor such as floor or building

location. This is a free form optional text field used for reporting only. Use some scheme which will be

valuable in your environment.

3. Telephone - Enter the telephone number where the user of this ID may be reached. This too is an

optional field which is intended to assist the System Administrator in locating a user when needed. A

recommended format for telephone numbers is area/nnn-nnnn (e.g. 303/755-1102). If all area codes are the

same for your users then you may wish not to include it in this field. Perhaps only the extension number is

needed in your environment.

4. Password - User passwords must conform to the specifications for length and requirements set in the

System Profile. If you are creating a new user ID, enter the user’s password at this prompt. It will be

displayed in the screen only while you are using this prompt. Passwords are encrypted on the SENTRY

database so that they may be protected from disclosure. Only the System Administrator may view

passwords.

Because it is a good security policy to change all passwords frequently, SENTRY provides a password

generator to assist the System Administrator in creating pronounceable yet meaningless passwords. To use

the SENTRY password generation program, enter “G” at the password prompt. A password conforming

to the System Profile specifications will be generated. Passwords generated by this program will be

composed of a consonant and vowel pattern in order to be pronounceable and therefore easier for the user

to remember WITHOUT writing them down! Optionally, the password generation program may be

Fitzgerald & Long

Section 2 - 12

SENTRY User’s Guide

configured (through the System Profile screen) to generate alphanumeric passwords, which will contain at

least 1 numeric character.

If the System Profile is set to allow null passwords to be optional, you may <RETURN> past this prompt

leaving it null. We do not recommend null passwords. Every user should have a unique user ID and

passwords should be changed on a regular basis.

5. UID - This field defines the UID number for the user. Because UNIX references users internally by

their number, not their user ID, a UID may not be unique (e.g. root UID = zero). All users with the same

UID have the same privileges. File ownership is defined by the UID not the user name. In our example

screen note that the UID of 0 (zero) for the user ID “peggy” is used for both “peggy” and “root”. These

user IDs appear to the right of the field in parentheses. Cross referencing is available at this prompt. Enter

“@” for a list of all users and their UID’s. Enter “@” followed by part of a user name to cross reference

by name. For example, enter “@long” to see a list of users with the name “Long”. SENTRY will

generate a new UID if the character “N” is entered at this prompt. Generally speaking, it not a good

security practice to have more than one user ID with the same UID. A standard UNIX convention is to

assign all “normal” users UID’s greater than 100. Numbers lower then 100 are customarily assigned to

special system user IDs. A record called NEXT.NUMBER in the SENTRY.CONTROL file is maintained

by SENTRY to provide the next available number. You may edit this record and start it at your preferred

starting number. The largest UID number is defined by the System Profile program and should be set no

higher than your system’s limit.

6. GID - This field defines the GID number for the user. This number specifies the user’s primary group

membership. Although the user may belong to supplementary groups, this field defines the primary group.

The name of this group is translated via the UNIX “group” file and the GID may be used in assigning file

system permissions.

To review a list of groups defined on your system and their GIDs, enter “@” at this prompt. You may

choose a group from this “pick” list. The name of the group will display in parentheses to the right of the

file. If you enter an “N” SENTRY assumes that you wish to create a new group. The next available GID

will be assigned and you will be prompted to provide a Group Name.

At this prompt you may enter “@” for a list of defined groups, “@” followed by part of a group name to

see a cross reference list, an existing GID, a new GID, the name of an existing group (SENTRY will look

up the GID), or an “N” and SENTRY will generate the next available GID. Because some versions of

UNIX limit the number of simultaneous supplementary groups to 8 your group assignments should be

carefully planned so that you have no user who requires membership in more than 9 groups (one primary

and 8 supplemental).

7. Home Directory - The directory to which the user is initially attached at login is commonly called the

“home” directory. Enter the path to this directory here. A cross reference list is available by entering

“@”. This will provide a list of all the paths defined as “home” directories in use by the users on your

system.

Fitzgerald & Long

SENTRY User’s Guide

Section 2 - 13

8. Command - This field normally defines the startup UNIX shell the user invokes. The System Profile

provides a “default”. If you wish to use the default you need only press <RETURN>. Otherwise, enter the

path to the UNIX shell you wish this user to invoke at startup.

9. Groups - This field is multi-valued and lists the user’s supplementary groups. The GID for each

group is displayed along with the group name in parentheses. Some systems allow only 8 simultaneous

supplementary groups. Take care that you plan your group memberships carefully so that you do not need

to exceed this limit.

At this prompt you may enter a new group name, an existing group name, a “@” for a list of existing

groups and their GID’s, or a “@” followed by part of a group name to see a cross reference list by group

name.

Enter field number, “C”ustom, “F”ile, “DEL”ete or <ESC> to exit - This is the standard

modifications prompt for the User Maintenance program. You may access any field by entering the

number to the left of the field, such as “2” for the Department field prompt.

SUN

Custom User Data Maintenance

08/16/00

User : peggy

1: Minimum password change (days)

2: Maximum password change (days)

3: Password change warning (days)

4: Maximum inactive time (days)

5: Expiration date (MM/DD/YY)

: 90

: 21

: 12/31/00

Enter field number, "F"ile or "<ESC>" to exit :

Figure 15 - This is an example of the ”Custom User Data Maintenance” data entry screen.

To execute this program, enter “2.” User Maintenance from the Main Sentry menu, after recalling an

exiting user or entering a new user you may enter “C” at the bottom prompt. Entering “C” invokes this