SECURESYSTEM(1M)					      SECURESYSTEM(1M)

NAME    [Toc]    [Back]

     securesystem - improve system security

SYNOPSIS    [Toc]    [Back]

     /usr/sysadm/privbin/securesystem [	-l <loginName> [ -j java | javascript
     | both | none ][ -P | -L |	-D ] ] [ -n yes	] [ -k yes|no ]	[ -s yes|no ]
     [ -c yes|no ] [ -o	yes|no ] [ -x yes|no ] [ -f yes|no ] [ -u yes ]	[ -w
     yes|no ]

DESCRIPTION    [Toc]    [Back]

     This command tries	to improve the security	of the system by modifying
     parameters	that affect the	security of the	system.	They include disable
     or	enable Java and/or JavScript for user accounts,	add password, lock or
     delete user accounts, remove NIS accounts,	lock out an account if it has
     no	password, use shadow password, turn off	graphical login	(clogin(1)),
     disable the use of	privilege accounts on system adminitration tools (see
     PrivilegeManager(1M)), disable the	display	of windows of remote systems
     on	the local system, turn off IP forwarding in the	kernel,	change UMASK
     to	be readable and	writable by owner only when a new file is created, and
     turn off outbox web server.

     Specifying	the yes	option improves	the security of	the system.  The no
     option reverse the	process. There are a few things	that this command
     cannot reverse, that is, it does not remove user account password,
     unlock, or	add user accounts including the	ones are deleted by the	remove
     NIS account option. See the UserManager(1M) if you	want to	perform	these
     functions.	Another	option that cannot be reversed is UMASK, it cannot be
     reset.

OPTIONS    [Toc]    [Back]

     -l	login  Specifies the name of the account to be modified. It is needed
	       for the following options that deal with	user accounts.

     -J	java|javascript|both|none
	       Java is to disable Java and enable JavaScript; javascript is to
	       disable JavaScript and enable Java; both	is disable Java	and
	       Javascript; none	is to enable Java and Javascript.

     -P	       Add a password to the specified account.	 The command will
	       prompt for the password on stdin.

     -L|-D     Lock or delete the specified account.

     -k	yes|no Yes means lock out account if it	has no password	and no means
	       accounts	without	password can still login. The MANDPASS option
	       in /etc/default/login is	updated.

     -s	yes|no Yes means create	shadow password	and no means if	/etc/showdow
	       file exists, merge it back into /etc/passwd.






									Page 1






SECURESYSTEM(1M)					      SECURESYSTEM(1M)



     -n	yes    Yes means remove	all NIS	accounts from /etc/passwd and the
	       process can not be reversed by this command.

     -c	yes|no Yes means do not	display	the graphical login application	and no
	       means use it.

     -o	yes|no Yes means only root has the privilege to	run system
	       administration task and no means	assigned user accounts can run
	       the tasks.

     -x	yes|no Yes means turn xhost(1) off and no means	turn it	on.

     -f	yes|no Yes means turn off ipforwarding in the kernel and no means turn
	       it on.

     -u	yes    Yes means change	UMASK in /etc/default/login to 022.

     -w	yes|no Yes means disable Outbox	Web Server and no means	enabling it.

FILES    [Toc]    [Back]

     /etc/passwd    User account password file
     /etc/shadow    User account shadow	password file
     /etc/default/login
		    Login parameters
     /usr/lib/desktop/xhoston
		    Remote display flag
     /etc/config/ns_fasttrack
		    Outbox web server control flag
     /etc/config/visuallogin
		    Graphical login window control flag

SEE ALSO    [Toc]    [Back]

     sysmgr(1M), UserManager(1M), PrivilegeManager(1M),	clogin(1), xhost(1),
     runpriv(1M).


									PPPPaaaaggggeeee 2222