Implementation Guide › Installing and Customizing a UNIX Endpoint › Maintenance Mode Protection (Silent Mode)

Maintenance Mode Protection (Silent Mode)

CA Access Control has a maintenance mode, also known as silent mode, for protection when the CA Access Control daemons are down for maintenance. In this mode, CA Access Control denies events while these daemons are down.

When CA Access Control is running, it intercepts security sensitive events and checks whether the event is allowed. Without activating maintenance mode, all events are permitted when CA Access Control services are down. With active maintenance mode, events are denied when CA Access Control daemons are down, stopping user activity while the system is maintained.

Maintenance mode can be tuned, and it is disabled by default.

When the CA Access Control security services are down:

• If maintenance mode is active, all security sensitive events are denied, except for special cases and for events executed by the maintenance user.
• If maintenance mode is disabled, CA Access Control does not intervene and execution is passed to the operating system.

When maintenance mode is activated and security is down, the prevented events are not logged in the audit log file.

To enable maintenance mode, follow these steps:

Important! If root is not the maintenance user, make sure you have an open session for the maintenance user as you will not be able to log in otherwise.

1. Make sure the CA Access Control daemons are down.
2. Using seini utility, change the token silent_deny value to yes.

   The token is located under SEOS_syscall section.

   seini -s SEOS_syscall.silent_deny yes
   

3. Change the token silent_admin value to the numeric UNIX UID that you want to let access the computer while CA Access Control daemons are down.

   seini -s SEOS_syscall.silent_admin <maintenance_UID>
   

   Note: root is the default maintenance mode user (UID 0).

   Important! If the maintenance user is not root, you must make the CA Access Control authorization daemon setuid to the root user so that you can start CA Access Control in maintenance mode. To make this change enter the following command:
   chmod 6111 seosd

4. Start CA Access Control daemons with seload command.

   Note: If the maintenance mode user is not root, start CA Access Control daemons with seosd command.