Red Hat Security Enhancements for tog-pegasus
		~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 Access to the Pegasus services:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   By default, with the configuration as shipped, the upstream Open Group Pegasus
   release allowed any user with an account on the machine (including root) to
   use the network HTTPS port 5989 (by default) and HTTP port 5988 services.
   On authentication failures, though there was the standard PAM authentication
   failure delay, no messages were logged to syslog. This meant that potentially
   a long-running cracker process could try millions of root passwords over the
   network and could possibly discover the root password .  If users were unwise
   enough to enable the HTTP service on port 5988, then root passwords could be
   sent unencrypted over the network.

   This situation was deemed unacceptable by Red Hat RHEL QA test and Security
   Response team engineers.
 
   So for the Red Hat tog-pegasus release, PAM access control was enabled, to 
   remove these vulnerabilities. There is now a "pegasus" user created during
   install, and users are recommended to use only that user to invoke CIM 
   operations over the network.

   By default:

   o root password authentication for CIM operations invoked over the network 
     HTTPS/HTTP services is denied - the root user is unable to invoke pegasus
     services over the network - only the "pegasus" user may do so.

   o the root user may invoke CIM operations over the HTTPS/HTTP ports on the
     local machine.
 
   o any user other than "pegasus" or "root" may not invoke pegasus services
     over the HTTPS/HTTP ports at all.
     
   o any PAM authentication failure will be logged to syslog 

   NOTE: after installation, you must set the password for the pegasus user -
         issue this command as root :
         # passwd pegasus
         - to enable CIM operation network service, if the pegasus user is 
         a local system user.

   Note also that even though a non-root user's password is used to authenticate
   with the cimserver, the cimserver and all CIM Operation Providers run as root.
   This was another reason to restrict use of CIM Operations to only one user.  

   The "pegasus" user may of course be a NIS, Kerberos, or LDAP user, which
   could be used as configured in /etc/nsswitch.conf or with the PAM stack.

   You may configure this differently, and at your own risk, by modifying the
   pam_access configuration file /etc/Pegasus/access.conf, or by removing the
   line:
       account required pam_access.so accessfile=/etc/Pegasus/access.conf
   from /etc/pam.d/wbem - then tog-pegasus' authentication behaviour would
   be the same as that of the upstream release.

 SELinux
 ~~~~~~~
   There is an SELinux policy for tog-pegasus shipped in selinux-policy-targeted-1.17.30-2.110+ .
   When SELinux is enabled in enforcing mode, the cimserver and providers are restricted to the
   operations allowed to the 'pegasus_t' security context. Also only the pegasus_exec_t context
   may modify the repository, and only the pegasus_exec_conf_t context may modify the pegasus 
   configuration files which are of pegasus_conf_t file context.

   It is also possible to have separate SELinux policy for each provider. Create wrapper
   in '/usr/libexec/pegasus' with its own specific SELinux label for each confined provider.
   The wrapper file name has to be in specific format '$MODULE-cimprovagt' (where $MODULE is
   value of PG_ProviderModule.ModuleGroupName as set during registration of the provider).

   Original Pegasus's cimprovagt binary was moved to '/usr/libexec/pegasus/cimprovagt',
   '/usr/sbin/cimprovagt' is simple shell script now, which passes all arguments to provider specific
   wrapper if it exists or directly to original cimprovagt in other cases.

   See example wrapper for Operating System Provider from sblim-cmpi-base package (which instruments
   Linux_OperatingSystem class):
   cmpiOSBase_OperatingSystemProvider-cimprovagt.example

 ExecShield
 ~~~~~~~~~~
   All tog-pegasus binary executables are compiled with ExecShield enabled, which make it nearly
   impossible to modify them or to poke executable code into them.