HP Archive Backup System for OpenVMS Guide to Operations

Table 5–4 Domain Access Control Options
Check Access Relaxed Access Explanation
Security
5.3 Implementing a Security Strategy
Set Set Access control is checked; if there
are no access control entries, access
is granted.
Because of the nature of access control, it is possible to set up access control on an object so that
no-one can access the object (even to restore its access control to a usable value). As such,
MDMS provides three “escape” mechanisms to allow certain individuals to access the object
even if not normally allowed through the access control mechanism:
• The owner of an object always has full access to the object. You can disable this feature by
clearing the owner field in the object.
• Any user that is listed in the access control list of the domain has the same level of access to
all objects.
• Finally, the user designated by “Last Updated By” in the domain has full access to all
objects. This is the user who last modified the domain object, and so is assumed to be a
trusted individual with recent access to the object.
To help in determining who the authorized domain users are, the SHOW DOMAIN operation
does not use access control checking, so that anyone with MDMS_SHOW_ALL rights can show
the domain.
Note
Access control checking is in addition to MDMS rights checking; both must be validated
for access to be granted. In addition, if access control checking is disabled in the
domain, MDMS rights checking is still performed for all operations.
5.3 Implementing a Security Strategy
Before assigning rights and access control entries to specific users you, as the system administrator,
should carefully review your MDMS and ABS domain and determine what kind of access to
allow your users.
The MDMS domain is a key determining factor as to what level of security you should implement.
The MDMS includes all locations, nodes, jukeboxes, drives, volumes and other MDMS
objects that are served by a single MDMS database. Implicit in this statement are that all users,
operators and system managers on nodes in the domain are also part of the MDMS domain and
need to be granted appropriate access to the domain resources.
Another key issue is what kind of security to the MDMS domain resources, including backup
tape volumes, jukeboxes and drives, do you wish to assign to the domain users. Some possible
scenarios with suggestions are shown below:
• Your domain consists of a single site that is managed by a single organization in a relatively
free environment: MDMS high-level rights assigned to specific users are probably all that is
necessary here. This is the simplest form of security to maintain.
Security 5–5