HP OpenView Operations Administrator's Reference - filibeto.org

About OVO Security
About Security in OVO Operations
Protecting Automatic and Operator-initiated Actions
Action requests and action responses can contain sensitive information
(for example, application password, application responses and so on) that
might be of interest to intruders. In a secure system, this is not problem.
However, if the requests and responses have to pass through a firewall
system or over the Internet, where packets may be routed through many
unknown gateways and networks, then you should take measures
required to improve security.
Protecting Shell Scripts
In addition, automatic actions and operator-initiated actions are
normally executed as root. To prevent security holes, it is essential that
you protect any shell scripts (for example, those used to switch users) by
assigning minimal rights and choose carefully the commands which an
application uses.
Switching the User for OVO Agents
To further increase security, you can switch the user for OVO agents
from user root to specified user account or group:
❏ HTTPS-based managed nodes
To switch the user for OVO HTTPS agents, use the command
ovswitchuser.sh. For details, see the man page ovswitchuser(1M).
❏ DCE-based managed nodes
To switch the user for OVO DCE agents, use the command
opcswitchuser.sh. For details, see the man page
opcswitchuser(1M).
Chapter 12 509