Chapter 11 vPars Flexible Administrative Capability

This chapter discusses the concepts and tasks on using the vPars Flexible Administrative Capability feature (formerly called Primary-Admin vPars Security). With this feature, you can specify vPars administration capabilities for zero, one, or more designated virtual partitions. Only superusers within the designated virtual partitions can perform the vPars administration commands that affect other virtual partitions; a superuser within a non-designated virtual partition can perform only operations that affect itself.

Additionally, for this flexible administrative capability to work, all the virtual partitions must be running the same version of vPars, except in the case of a mixed HP-UX 11i vPars environment (such as a mixed HP-UX 11i v2/v3 vPars environment).

Flexible administrative capability is supported for vPars A.03.03 and later, vPars A.04.02 and later, and vPars A.05.01 and later.

Flexible administrative capability is supported in mixed HP-UX 11i vPars environments. However, HP recommends that in mixed environments the designated administrative virtual partitions be ones that are capable of performing all administrative functions. For example, in a mixed HP-UX 11i v2/v3 vPars environment only the HP-UX 11i v3 partitions (running vPars A.05.xx) can perform vparmodify, vparremove, and vparcreate operations on other partitions. If only the HP-UX 11i v2 partitions were designated administrative partitions, then vPars administration abilities would be limited for that environment.

	NOTE: Applying RBAC to vPars A.04.01 White Paper  You can apply the existing HP-UX Security feature RBAC (Role-based Access Control) to vPars A.04.01. For information, see the white paper titled Securing Virtual Partitions with HP-UX Role-Based Access Control available at http://docs.hp.com. HP-UX Security and other Security Applications  This feature is not intended to replace existing HP-UX security or security applications. It provides as a way to limit intentional access but is not intended to substitute security or security application that eliminate malicious or unintentional circumvention of commands or provide kernel level security isolation. This feature is intended to address tighter vPars administration control requirements in certain customer deployments.