navidpaya

Kudos
My company is dealing with very sensitive and secret information so we need to implement some security measures. My task is the OS and particularly the UNIX family. Now I need to make sure that the users have just enough access to do the stuff they need to. For instance, if a user needs to read some log files using cat or tail, that's all I want him to do.
We use SuSE 10 as our distro of choice (it's not my call, so we have to assume it can not be changed RHEL or sth else). I tried to implement it using apparmor but I can't figured out how it works, especially the restricted shell is not as flexible as I hoped it would be. Does anyone have any experience doing this?
We'd rather have a rbac (role-based access control solution to make the administration easier. So what do you suggest? Any help is appreciated.

Rubberman

Use a mainstream enterprise class linux system that supports the SELinux extensions for mandatory access controls and other such security measures. Red Hat Enterprise Linux (and the free version of that, CentOS) supports SELinux out-of-the-box. SELinux was developed by the US National Security Agency to provide tools for systems that have to work in top-secret and other secure facilities. If it's good enough for the NSA and CIA, it's probably good enough for the rest of us!

__________________
Sometimes, real fast is almost as good as real time.

navidpaya

Thanks for your suggestion. As I said in my post, the company has solutions which run on SuSE 10 and it's not willing to change that any time soon so I have to go with AppArmor. But I've also taken a look at SELinux and sounds like it takes some realy effort to implement and much more to maintain.
Acutually I was looking for sth much more straight-forward, especially when it comes to RBAC but sounds like there's no out of the box solution for such stuff. You have to wrestle with things such as restricted shells or sudo sometimes. So far, I've reckoned that ACL is the most promising of all, except for the fact that threre's no such thing as profile in it.