test

Solaris Trusted Extensions User's Guide

Chapter 2 Logging In to Trusted Extensions (Tasks)

This chapter describes the two desktops and the login process on a system that is configured with Solaris Trusted Extensions. This chapter covers the following topics:

Desktops and Login in Trusted Extensions

The desktop that you use in Trusted Extensions is protected. Labels provide a visible indication of protection. Applications, data, and your communications are labeled. The desktop is a trusted version of the GNOME desktop. The menu item is Solaris Trusted Extensions (GNOME).

The login screen is not labeled. The login process requires you to establish a label for your session. Once you have chosen a label, the desktop, its windows, and all applications are labeled. In addition, applications that affect security are visibly protected by a trusted path indicator.

Trusted Extensions Login Process

The login process on a system that is configured with Trusted Extensions is similar to the login process for the Solaris OS. However, in Trusted Extensions, you examine several screens for security-relevant information before the desktop session can be started. The process is described in more detail in the sections that follow. Here is a brief overview.

  1. Desktop choice – As in the Solaris OS, you choose which desktop to use. In Trusted Extensions, you must choose the Solaris Trusted Extensions (GNOME) desktop.

  2. Identification – As in the Solaris OS, you type your username in the Username field.

  3. Authentication – As in the Solaris OS, you type your password in the Password field.

    Successful completion of identification and authentication confirms your right to use the system.

  4. Message checking and session type selection – You examine the information in the Last Login dialog box. This dialog box displays the time you last logged in, any messages from the administrator, and the security attributes of your session. If you are permitted to operate at more than one label, you can specify the type of session, single-level or multilevel.

    Note –

    If your account restricts you to operate at one label, you cannot specify the type of session. This restriction is called a single-level or single-label configuration. For an example, see Session Selection Example.

  5. Label selection – In the label builder, you choose the highest security level at which you intend to work while in your session.

Note –

By default, remote login is not supported for regular users in Trusted Extensions. If remote login is supported by your site, check with your administrator for the procedure. If your administrator has configured Xvnc, a virtual networking computer (vnc) can be used to remotely display a multilevel desktop. For the procedure, see Logging In Remotely to Trusted Extensions.

Desktop Choice Before Login

When a Solaris workstation is not in a work session, it displays the login screen. The Trusted Extensions login screen is similar to the Solaris login screen. As in the Solaris login screen, you can choose a desktop from the Options menu.

Identification and Authentication During Login

Identification and authentication during login are handled by the Solaris OS. The login screen initially contains the Username prompt. This part of the login process is referred to as identification.

After you have entered the username, the password prompt is displayed. This part of the process is referred to as authentication. The password authenticates that you are indeed the user who is authorized to use that username.

A password is a private combination of keystrokes that validates your identity to the system. Your password is stored in an encrypted form and is not accessible by other users on the system. It is your responsibility to protect your password so that other users cannot use it to gain unauthorized access. Never write down your password or disclose it to anyone else because a person with your password has access to all your data without being identifiable or accountable. Your initial password is supplied by your security administrator.

Review Security Attributes During Login

The review of security attributes is handled by Trusted Extensions, not by the Solaris OS. Before login is complete, Trusted Extensions displays the Last Login dialog box. This dialog box provides status information for you to review. You can review past information, such as when the system was last used by you. You can also review the security attributes that are in effect for the upcoming session. If your account is configured to operate at more than one label, you can select a single-level or a multilevel session.

You then view your single label, or choose a label and clearance from the label builder.

Logging In to Trusted Extensions

The following tasks step you through logging in to Trusted Extensions. You review and specify security information before reaching the desktop.

ProcedureChoose a Trusted Desktop

  1. On the login screen, choose a desktop from the Options --> Sessions menu.

    For Trusted GNOME, choose Solaris Trusted Extensions (GNOME).

  2. Continue with Identify and Authenticate Yourself to the System.

ProcedureIdentify and Authenticate Yourself to the System

  1. In the Username field of the login screen, type your username.

    Be sure to type your username exactly as your administrator assigned it to you. Pay attention to spelling and capitalization.

  2. If you made an error, restart.

    • To retype your username, click Start Over.

    • To restart the windowing system completely, click Reset Login from the Options menu.

      Go to Choose a Trusted Desktop after your restart.

  3. Confirm your entry.

    Press Return to confirm your username.

    Caution – Caution –

    You should never see the trusted stripe when the login screen appears. If you ever see the trusted stripe while attempting to log in or unlock the screen, do not type your password. There is a possibility that you are being spoofed. A spoof is when an intruder's program is masquerading as a login program to capture passwords. Contact your security administrator immediately.

  4. Type your password in the password entry field, and press Return.

    For security purposes, the characters do not display in the field. The system compares the login name and password against a list of authorized users.

Troubleshooting

If the password that you provided is incorrect, a dialog box appears with the message:

Login incorrect; please try again.

Click OK to dismiss the error dialog box. Then, type the correct password.

ProcedureCheck Messages and Select Session Type

If you do not restrict yourself to a single label, you can view data at different labels. The range in which you can operate is bounded at the upper end by the session clearance and at the lower end by the minimum label that your administrator assigned to you.

  1. In the Last Login dialog box, check that the time of your last session is accurate.

    Always check that nothing is suspicious about the last login, such as an unusual time of day. If you have reason to believe that the time is not accurate, contact your security administrator.

    Figure 2–1 Last Login Dialog Box

    Window shows date and time of the user's last login, Message of the Day, and session attributes. Shows a single-label session button.

  2. Check for any messages from the administrator.

    The Message of the Day field can contain warnings about scheduled maintenance or security problems. Always review the information in this field.

  3. Examine the security attributes of your session.

    As Figure 2–1 shows, the Last Login dialog box indicates any roles that you can assume, your minimum label, and other security characteristics.

  4. (Optional) If you are permitted to log in to a multilevel session, decide if you want a single-label session.

    Click the Restrict Session to a Single Label button to log in to a single-label session.

    You are presented with a label builder. If you are logging in at a single label, the label builder describes your session label. In a multilabel system, the label builder enables you to choose your session clearance.

  5. Confirm your label choice.

    Figure 2–2 Label Builder

    Label Builder dialog box shows Task identifier, selected clearance. Shows update field, and classification and compartments to create new clearance.

    • Accept the default, unless you have a reason not to.

    • For a multilevel session, select a clearance.

      • Deselect the current clearance, and click a classification and a sensitivity label.

      • Or, in the Clearance field, type a clearance.

      • Or, in the Update With field, type a label.

    • For a single-level session, select a label.

      • Deselect the current label, and click a different classification.

      • Or, in the Update With field, type a label.

  6. Click OK.

    The trusted desktop appears.

ProcedureTroubleshoot Login Problems

  1. If your username or password is not recognized, check with the administrator.

  2. If your label range is not permitted on your workstation, check with the administrator.

    Workstations can be restricted to a limited range of session clearances and labels. For example, a workstation in a lobby might be limited to PUBLIC labels only. If the label or session clearance that you specify is not accepted, check with an administrator to determine if the workstation is restricted.

  3. If you have customized your shell initialization files and cannot log in, you have the following two options.

    • Contact your system administrator to correct the situation.

    • If you can become root, log in to a failsafe session.

      In a standard login, the shell initialization files are sourced at startup to provide a customized environment. In a failsafe login, the default values are applied to your system and no shell initialization files are sourced.

      In Trusted Extensions, failsafe login is protected. Only superuser can access failsafe login.

      1. As in the Solaris OS, choose Options –> Failsafe Session on the login screen.

      2. When prompted, provide your username and password.

      3. When prompted for an additional password, provide the password for root.

Logging In Remotely to Trusted Extensions

Virtual Network Computing (vnc) provides a way for you to access a central Trusted Extensions system from your laptop or home computer. The administrator at your site must configure the Solaris Xvnc software to run on the server and client systems. You can work at any label in your label range that is installed on the server.

ProcedureHow to Log In to a Remote Trusted Extensions Desktop

Before You Begin

Your administrator has completed How to Use Xvnc to Remotely Access a Trusted Extensions System in Solaris Trusted Extensions Administrator’s Procedures.

  1. In a terminal window, connect to the Xvnc server.

    Type the name of the server that your administrator has configured with Xvnc.


    % /usr/bin/vncviewer Xvnc-server

  2. Log in.

    Follow the procedures in Logging In to Trusted Extensions.

    You can now work on the Trusted Extensions desktop in the Xvnc window.