You can override the protection applied to a system by authorizing certain files based on their SHA-1 or SHA-256 values.
Authorizing files by their SHA-1 or SHA-256 value allows them to run on a protected system. If a file is not added to the allow list but configured as an authorized file, it is allowed to run. Regardless of the source of a file, if the SHA-1 or SHA-256 value matches, the file is allowed to run. Likewise, files can be banned from execution based on their checksum, preventing them to run even if the files are in the allow list.
You can also provide updater permissions to an authorized file. Configuring an authorized binary as an updater provides the updater permissions in addition to the execution. An authorized file that is configured as an updater is allowed to update or run software on a protected system.
Note
When you upgrade from TACC 6.6.3 or an earlier version, the default hash algorithm is SHA-1. The SHA-1 checksum will continue to work for sadmin auth allow and sadmin auth ban commands.
To migrate from SHA-1 to SHA-256, follow these steps:
Disable TACC.
Run sadmin config set HashAlgorithm=SHA256.
Enable TACC.
To verify the change, run sadmin config show HashAlgorithm from the command line.