Supplement for Installing Adaptive Server for Common Criteria Configuration

Transcription

1 Supplement for Installing Adaptive Server for Common Criteria Configuration Document ID: DC Last revised: November 2004 Topic Page 1. Product summary 1 2. Special installation instructions 1 3. Environmental requirements 4 1. Product summary The Evaluated Configuration consists of Adaptive Server version with Security and Directory Services option. The Evaluated Configuration enables only Row Level Access Control and Auditing. 2. Special installation instructions To install the server in the evaluated configuration: 1 Install adaptive server from CD. Installation instructions can be found in the Installation Guide for your platform. While performing the installation, select the following options: when prompted to choose between typical, full or custom install, choose typical install. when prompted to configure new servers, choose Adaptive Server only. Copyright by Sybase, Inc. All rights reserved. Sybase, the Sybase logo, ADA Workbench, Adaptable Windowing Environment, Adaptive Component Architecture, Adaptive Server, Adaptive Server Anywhere, Adaptive Server Enterprise, Adaptive Server Enterprise Monitor, Adaptive Server Enterprise Replication, Adaptive Server Everywhere, Adaptive Warehouse, Afaria, Answers Anywhere, Anywhere Studio, Application Manager, AppModeler, APT Workbench, APT-Build, APT-Edit, APT-Execute, APT-Translator, APT-Library, AvantGo Mobile Delivery, AvantGo Mobile Inspection, AvantGo Mobile Marketing Channel, AvantGo Mobile Pharma, AvantGo Mobile Sales, AvantGo Pylon, AvantGo Pylon Application Server, AvantGo Pylon Conduit, AvantGo Pylon PIM Server, AvantGo Pylon Pro, Backup Server, BizTracker, ClearConnect, Client-Library, Client Services, Convoy/DM, Copernicus, Data Pipeline, Data Workbench, DataArchitect, Database Analyzer, DataExpress, DataServer, DataWindow, DataWindow.NET, DB-Library, dbqueue, Developers Workbench, Direct Connect Anywhere, DirectConnect, Distribution Director, e-adk, E-Anywhere, e-biz Impact, e-biz Integrator, E-Whatever, EC Gateway, ECMAP, ECRTP, efulfillment Accelerator, Embedded SQL, EMS, Enterprise Application Studio, Enterprise Client/Server, Enterprise Connect, Enterprise Data Studio, Enterprise Manager, Enterprise SQL Server Manager, Enterprise Work Architecture, Enterprise Work Designer, Enterprise Work Modeler, eprocurement Accelerator, EWA, Financial Fusion, Financial Fusion Server, Gateway Manager, GlobalFIX, ianywhere, ianywhere Solutions, ImpactNow, Industry Warehouse Studio, InfoMaker, Information Anywhere, Information Everywhere, InformationConnect, InternetBuilder, iscript, Jaguar CTS, jconnect for JDBC, M2M Anywhere, Mail Anywhere Studio, MainframeConnect, Maintenance Express, Manage Anywhere Studio, M-Business Channel, M-Business Network, M-Business Server, MDI Access Server, MDI Database Gateway, media.splash, MetaWorks, mfolio, Mirror Activator, MySupport, Net-Gateway, Net-Library, New Era of Networks, ObjectConnect, ObjectCycle, OmniConnect, OmniSQL Access Module, OmniSQL Toolkit, Open Biz, Open Client, Open ClientConnect, Open Client/Server, Open Client/Server Interfaces, Open Gateway, Open Server, Open ServerConnect, Open Solutions, Optima++, PB-Gen, PC APT Execute, PC DB-Net, PC Net Library, PocketBuilder, Pocket PowerBuilder, Power++, power.stop, PowerAMC, PowerBuilder, PowerBuilder Foundation Class Library, PowerDesigner, PowerDimensions, PowerDynamo, PowerScript, PowerSite, PowerSocket, Powersoft, PowerStage, PowerStudio, PowerTips, Powersoft Portfolio, Powersoft Professional, PowerWare Desktop, PowerWare Enterprise, ProcessAnalyst, QAnywhere, Rapport, RemoteWare, RepConnector, Replication Agent, Replication Driver, Replication Server, Replication Server Manager, Replication Toolkit, Report-Execute, Report Workbench, Resource Manager, RFID Anywhere, RW-DisplayLib, RW-Library, S-Designor, SDF, Secure SQL Server, Secure SQL Toolset, Security Guardian, SKILS, smart.partners, smart.parts, smart.script, SQL Advantage, SQL Anywhere, SQL Anywhere Studio, SQL Code Checker, SQL Debug, SQL Edit, SQL Edit/TPU, SQL Everywhere, SQL Modeler, SQL Remote, SQL Server, SQL Server Manager, SQL SMART, SQL Toolset, SQL Server/CFT, SQL Server/DBM, SQL Server SNMP SubAgent, SQL Station, SQLJ, STEP, SupportNow, S.W.I.F.T. Message Format Libraries, Sybase Central, Sybase Client/Server Interfaces, Sybase Financial Server, Sybase Gateways, Sybase IQ, Sybase MPP, Sybase SQL Desktop, Sybase SQL Lifecycle, Sybase SQL Workgroup, Sybase User Workbench, SybaseWare, Syber Financial, SyberAssist, SybFlex, SyBooks, System 10, System 11, System XI (logo), SystemTools, Tabular Data Stream, TradeForce, Transact-SQL, Translation Toolkit, UltraLite, UltraLite.NET, UNIBOM, Unilib, Uninull, Unisep, Unistring, URK Runtime Kit for UniCode, VisualWriter, VQL, WarehouseArchitect, Warehouse Control Center, Warehouse Studio, Warehouse WORKS, Watcom, Watcom SQL, Watcom SQL Server, Web Deployment Kit, Web.PB, Web.SQL, WebSights, WebViewer, WorkGroup SQL Server, XA-Library, XA-Server, XcelleNet, and XP Server are trademarks of Sybase, Inc. 11/04

2 2. Special installation instructions Adaptive Server Enterprise version Follow instructions in installation guide to install license option for Sybase Security and Directory Services package. 3 Login to Adaptive Server using isql and lock the probe login. isql -Usa -P -S<your_server_name> 1> sp_locklogin 'probe', 'lock' 2> go Account locked. (return status = 0) Additionally, on Windows installations, lock the mon_user login: 1>sp_locklogin 'mon_user', 'lock' 2> go Account locked. (return status = 0) 4 Ensure that all physical devices created by the installation process have write permission only for the operating system user who installs, configures and runs Adaptive Server (generally user sybase ). On a UNIX machine, this can be verified using the following command: % ls -l total rw-rw-r-- 1 sybase sybase May 13 13:55 master.dat -rw-rw-r-- 1 sybase sybase May 13 13:48 sproc.dat % chmod 640 master.dat sproc.dat % ls -l total rw-r sybase sybase May 13 13:55 master.dat -rw-r sybase sybase May 13 13:48 sproc.dat Note The above commands assume that OS files master.dat and sproc.dat were used to create the master and sybsystemprocs devices. This verification should be carried out for any new devices created during the lifetime of Adaptive Server. For more information on managing devices in Adaptive Server, see the System Administration Guide. 5 To configure auditing, see the Auditing chapter in System Administration Guide. 2 Common Criteria Supplement for Adaptive Server Enterprise

3 Adaptive Server Enterprise version Special installation instructions 6 To configure login triggers, see the Managing User Permissions chapter in System Administration Guide. Note The Evaluated Configuration does not enable any other options. 2.1 If you are installing Adaptive Server on Windows Perform the following steps if you installed the Evaluated Configuration on the Windows platform. Perform these steps as the same sybase user that installed Adaptive Server. The sybase user must be a member of Windows systemdefined group Administrators to have the access privileges required to complete these steps. For more information about installing Adaptive Server, see the Installation Guide for Windows. 1 Stop the Adaptive Server services. Open Control Panel Administrator Tools Services. Select each of the Sybase Adaptive Server entries and stop them by right-clicking on each entry and selecting Stop. There are separate entries in Services for Sybase Adaptive Server SQLServer, XPServer, BCKServer, MONServer, and SYSAM. 2 Install SybProtect. Download the SybProtect utility (EBF 12326) from and extract all the files into a temporary location on your local disk using WinZIP. Follow the installation instructions in the EBF cover letter to install the SybProtect utility. After completing the installation, use the Windows Administrative Tools to stop the SybProtect service. 3 Set access permissions. Identify the drives and folders where the Adaptive Server software is installed, and identify Adaptive Server's disk devices. Use the Windows command-line tool, cacls, or Windows Explorer to set access permissions on the identified drives and folders. See your Windows documentation or consult with your Windows administrator for information about cacls or Windows Explorer. Note cacls is a command-line utility available on Windows 2000 and later versions. On earlier Windows versions, cacls is available from the NT Resource Kit. Sybase recommends granting full control to user sybase and denying access to others on all identified drives, files, and folder hierarchies. Common Criteria Supplement for Adaptive Server Enterprise 3

4 3. Environmental requirements Adaptive Server Enterprise version If users other than sybase need access to files (for example, configuration files, programs, libraries, and so on) in the folder hierarchy, you should limit their access to read and execute permissions. However, system administrators should review this access and any further access permissions to ensure they are required. 4 Start the Adaptive Server services as the user sybase: Open Control Panel Administrator Tools Services and select each of the Sybase Adaptive Server entries, including the Adaptive Server entries listed in step 1 and the SybProtect service. Set the Log On properties for each of the entries to use sybase and the password for this account. Performing this grants the user sybase the log on as a service privilege by Windows. 5 Start Adaptive Server services. Using the Administrative Tools, open Services and select each of the Sybase Adaptive Server entries that were stopped in step 1 and start them, including the SybProtect service 3. Environmental requirements The following are environmental characteristics that are required to administer Adaptive Server in a secure manner: Authorized administrators must be non-hostile, appropriately trained and follow all administrator guidance. The IT environment must provide support commensurate with the expectations of the Adaptive Server. The IT environment must provide a time source that provides reliable time stamps. Generally, this is provided by the hardware. The IT environment must provide protection to the Adaptive Server and its assets from external interference or tampering. The system administrator will provide authorized administrators with the necessary information for secure management of Adaptive Server. Adaptive Server must be installed, configured, managed and maintained in accordance with its guidance documentation and applicable security policies and procedures by appropriately trained and trusted administrator personnel. System administrators will follow Adaptive Server System Administration guidelines to establish and maintain security. 4 Common Criteria Supplement for Adaptive Server Enterprise

5 Adaptive Server Enterprise version Environmental requirements There will be no general-purpose computing capabilities (e.g., compilers or user applications) available on Adaptive Server servers, other than those services necessary for the operation, administration and support of the DBMS. Physical security must be provided within the domain for the value of the IT assets protected by Adaptive Server and the value of the stored, processed, and transmitted information. The IT environment and its assets will be protected from external interference, tampering or unauthorized disclosure. Each IT entity Adaptive Server relies on for security functions will be installed, configured, managed, maintained and provide the applicable security functions in a manner appropriate to the IT entity, and consistent with the security policy of Adaptive Server and the relationship between them. Administrators must not leave sessions unattended. Common Criteria Supplement for Adaptive Server Enterprise 5

6 3. Environmental requirements Adaptive Server Enterprise version Common Criteria Supplement for Adaptive Server Enterprise