Moxa Technologies UC-8100-LX, Руководство пользователя программного обеспечения, Страница: 43 / 90

UC-8100-LX Software Manual Security On UC-8100-LX
4-7
89B
Sealing/Unsealing Data
tpm_sealdata and tpm_unsealdata command are used to seal or unseal data .They are invoked with the
following parameters:
-i, --infile FILE
Filename containing key to seal/unseal. Default is STDIN.
-o, --outfile FILE
Filename to write sealed/unseal key to. Default is STDOUT.
-p, --pcr NUMBER
PCR to seal data to. Default is none. This option can be specified
multiple times to choose more than one PCR.
After invoking the tpm_sealdata function, tpm_sealdata retrieves random data from the TPM. To do this,
the tpmGetRandom function invokes the method Tspi_TPM_GetRandom() of the class TPM . Then
tpm_sealdata sets the SRK policy using the classes Policy and Context. The next functions build an RSA key
object that will be created by the TPM. Then, an RSA key is created and loaded. The subsequent functions build
an encrypted data object that will hold the encrypted version of the symmetric key. The final functions encrypt
the given data and seal it to the symmetric key. It is possible to invoke this command with several command
line parameters.
Sealing Data
moxa@Moxa:~$ tpm_sealdata -i secrect -o secrect.enc -p 12 -p 14
Enter SRK password:
Unsealing Data
moxa@Moxa:~$ tpm_unsealdata -i secrect.enc -o plain
36B
SUDO Mechanism
In the UC-8100-LX, the root account is disabled for better security. Sudo is a program designed to let system
administrators allow some users to execute some commands as root (or another user). The basic philosophy is
to give as few privileges as possible but still allow people to get their work done. Using sudo is better (safer)
than opening a session as root for a number of reasons, including:
Nobody needs to know the root password (sudo prompts for the current user's password). Extra privileges can
be granted to individual users temporarily, and then taken away without the need for a password change.
It is easy to run only the commands that require special privileges via sudo; the rest of the time, you work as
an unprivileged user, which reduces the damage that mistakes can cause.
The code below shows that some system level command is not accessable to user moxa directly.