IBM AIX Continuous Availability Features - IBM Redbooks

2.7 Security
eServer Certification Study Guide - AIX 5L Performance and System Tuning, SG24-6184,
which is available at the following site:
http://www.redbooks.ibm.com/redbooks/pdfs/sg246184.pdf
The raso command
The raso command is used to configure “selected” RAS tuning parameters. This command
sets or displays the current or next-boot values to configure selected tuning parameters for
the RAS tuning parameters it supports. The command can also be used to make permanent
changes, or to defer changes until the next reboot.
The specified flag determines whether the raso command sets or displays a parameter. The
-o flag can be used to display the current value of a parameter, or to set a new value for a
parameter.
Here, we show the command syntax for the raso command:
Command Syntax
raso [ -p | -r ] [ -o Tunable [ = Newvalue ] ]
raso [ -p | -r ] [ -d Tunable ]
raso [ -p ] [ -r ] -D
raso [ -p ] [ -r ] [-F]-a
raso -h [ Tunable ]
raso [-F] -L [ Tunable ]
raso [-F] -x [ Tunable ]
Note: Multiple -o, -d, -x, and -L flags can be specified.
As with all AIX tuning parameters, changing a raso parameter may impact the performance or
reliability of your AIX LPAR or server; refer to IBM System p5 Approaches to 24x7 Availability
Including AIX 5L, for more information about this topic, which is available at the following site:
http://www.redbooks.ibm.com/redbooks/pdfs/sg247196.pdf
We recommend that you do not change the parameter unless you are specifically directed to
do so by IBM Software Support.
The security features in AIX also contribute to system availability.
Role-Based Access Control
Role-Based Access Control (RBAC) improves security and manageability by allowing
administrators to grant authorization for the management of specific AIX resources to users
other than root by associating those resources with a role that is then associated with a
particular system user. Role-Based Access Control can also be used to associate specific
management privileges with programs, which can reduce the need to run those programs
under the root user or via setuid.
AIX Security Expert LDAP integration
The AIX Security Expert provides clients with the capability to manage more than 300 system
security settings from a single interface. The AIX Security Expert has been enhanced in AIX
V6.1 with an option to store security templates directly in a Lightweight Directory Protocol
(LDAP) directory, thus simplifying implementation of a consistent security policy across an
entire enterprise.
Chapter 2. AIX continuous availability features 51