spec - Local Sector 7 web page

Secur ity IssuesAt some installations, you may wish to prevent ordinary users from accessingselected motors. spec offers several levels of security. The security works with theUNIX file ownership and protection mechanisms, so it is important that user andgroup ownership of the configuration files and file write permission be properly set.To restrict configuration modification to a single user or group, you must set the writepermission of the diffractometer’s associated config file accordingly. Typechmod 644 /usr/lib/spec.d/fourc/config to allow only the owner of the file tomodify it. Setting the mode to 664 allows users in the owner’s group to also modifythe file.There are there basic levels of security for each motor. The first level is the mostrestrictive, as it prevents the motor from being moved and prevents changes to theposition being made in the settings file. The motor position can still be read from themotor controller, though, and the user angle can still be changed using the chg_offset()function (invoked by the set macro). If there is ever a conflict between thecurrent position and the position in the settings file, such as might happen if thepower was turned off to the motor controller, the controller registers are automaticallyadjusted to match the position in the settings file without moving the motor.The second level of security allows a motor to be moved, but prevents the softwarelimits from being changed. Not only is the set_lim() command restricted, but alsothe chg_dial() command, as a change in the dial position would effectively changethe position of the limits.The third level offers no security and allows any operation on a motor.When these motor restrictions are set in the config file, the restrictions apply toeveryone, even the owner of the config file. To move a restricted motor, you must firstchange the config file.ExtraProtectionAt some spec installations, the administrators need to prevent users from accessingor modifying the configuration of certain motors. The edconf program supports a wizardmode that allows such protection. Youwill need to create a user in the systempassword file named specwiz. If you type ˆW while running edconf you will beprompted for the wizard’s password. If you enter it properly, you will be able to selectadditional levels of configuration protection.To prevent users from disabling the wizard protections by editing the config file byhand, you can use file protection features built in to UNIX. One possibility is to make210 ADMINISTRATOR’S GUIDE INTERIM WORK-IN-PROGRESS (8/16/01) NOT FOR GENERAL DISTRIBUTION