Bay Networks 5390, Administering, Page: 493 / 888

893-741-B A15-73
Using Model 5390 Security
An asterisk (*) can be used as a wild card in place of a host name or the host portion of an IP address.
Following is an example of two restricted-host entries:
5390_01: hosta,hostb,hostf,132.245.6.23
5390_02: hostc,132.245.6.15,hostf,132.245.6.23,\
hosth,5390_01
In the previous example, the first entry prevents users on 5390_01 (connection security is enforced)
from accessing hosta, hostb, hostf, and the IP address 132.245.6.23. The second entry prevents users
on 5390_02 from accessing hostc, hostf, hosth, the IP addresses 132.245.6.15 and 132.245.6.23,
and 5390_01.
Hosts that are not listed in the file are considered unrestricted. Because ACP searches the
acp_restrict file sequentially, the order of placement in the file is important. The search stops when
it finds a host that matches. You can use unrestricted host entries to prevent users on one network
from accessing hosts on any other network.
In the following example, the policy finds the unrestricted definition for Model 5390 servers and
hosts on network 192.17.5 and grants access. It finds the restricted definition for hosts on any other
network and does not grant access. The first entry unrestricts all IP addresses on network 192.17.5
from all Model 5390 servers on that network, but restricts access to any IP address off that network.
192.17.5.*~ 192.17.5.*
192.17.5.*: *
The next example illustrates wild cards. A publichost is defined as accessible from all Model 5390
servers and a securehost is inaccessible from any Model 5390 server.
*~ publichost
*: securehost
If permission is granted to a connection security request, the user follows the normal login procedure.
If the request is denied, the message Permission denied is displayed and the session (job) is aborted.
Logging Security Events
Host-based security can generate audit trails of user activity. Each time the security server grants
or denies a request for user access, the security server logs it. Each event is logged as a message in
a file defined as acp_logfile, which is located by default in the /usr/annex directory.