Chapter 9 Installing Trusted Solaris Over a Network

When installing Trusted Solaris software over a network, the system administrator uses the Solaris 8 Advanced Installation Guide in conjunction with the Trusted Solaris exceptions and additions described in this chapter.

Due to the security features in the Trusted Solaris environment, Trusted Solaris software modifies some of the procedures used for network installation, JumpStart installation, and Custom JumpStart installation. Also, the Trusted Solaris security and system administrators must enable access to commands on the installation CD-ROM or its image.

Trusted Solaris Modifications to Network Installation

Trusted Solaris software modifies network installation commands and procedures that require greater security. For example, the Volume Manager adds a mounting-user directory when mounting devices in the Trusted Solaris environment.

Modifications to Network Installation Commands

The following commands and actions are used when installing Solaris software or Trusted Solaris software over a network, and their use is modified in the Trusted Solaris environment. The following listing describes the additional procedures or security requirements. Commands that do not require a change in procedure are not listed. See the "Preparing to Install Solaris Software Over the Network" in Solaris 8 Advanced Installation Guide for the installation procedures themselves.

Modifications to Network Installation Procedures

The following procedures are slightly different in the Trusted Solaris environment. The admin role installs software at the label ADMIN_LOW; the secadmin role modifies files connected with security.

ethers: 			files nisplus dns
netmasks: 			files nisplus dns
bootparams: files nisplus dns

Example 9-1 Admin Role Verifying that a Command is Available

If the commands add_install_client and rm_install_client are in the admin role's profile, the profiles(1) command should display something like the following for a disk image:

$ profiles -l | grep install_client
/export/install/ts8_sparc/add_install_client: 4,5,6,10,11,12,17,30,32,33,35,36,39,52,55,57,61,68,69
/export/install/ts8_sparc/rm_install_client:  4,5,6,10,11,12,17,30,32,33,35,36,39,52,55,57,61,68,69

Additional Steps to Set up Software Installation

To install from a CD-ROM, users who can assume administrative roles must be present. The secadmin role gives all allowed privileges to the CD-ROM device and modifies profiles where necessary. The admin role allocates the device, changes the permissions on the parent of the mount point, and installs the software.

Give Mounted Media All Allowed Privileges

1. Log in as a user who can assume the secadmin role and assume it.

2. Open the Admin Editor from the System_Admin folder.

3. Assign all allowed privileges to mounted removable media in the /etc/rmmount.conf file, as in:

   mount * hsfs udfs ufs -o nosuid allowed=all

4. Write the file with :wq! and exit the editor.

Modify Permissions of Mount Point Parent

In the admin role, after allocating the CD-ROM, a File Manager will pop up showing the mount point of the CD-ROM. If it does not appear, bring up a File Manager from the Front Panel.

For Trusted Solaris software, the mount point should be /cdrom/admin-cdrom_0/trusted_sol_8_sparc or /cdrom/admin-cdrom_0/trusted_sol_8_ia.

1. In the File Manager, highlight /cdrom/admin-cdrom_0, the parent of the mount point.

2. From the Selected menu, choose Properties.

   Note that the directory, named CD-ROM_FOLDER, has mode 700, so it is not searchable. The following steps will fix that.

3. Click the Show Access Control List button, then Add ...

4. Highlight the Mask entry and click Change.

5. Change the Mask to Read and Execute, and click Change.

6. Click Add..., and enter root in the User field, giving it Read and Execute.

7. Click Add, then click OK to exit the dialog.

8. Leave the File Manager up, available for the installation setup commands.

Load Trusted Solaris Images from CDs

1. In the File Manager, open the Tools folder, one of /cdrom/admin-cdrom_0/trusted_sol_8_sparc/Trusted_Solaris_8/Tools or /cdrom/admin-cdrom_0/trusted_sol_8_ia/Trusted_Solaris_8/Tools.

2. From the File menu select Open Terminal.

3. Still in the admin role, transfer the files from the first CD to the install server by typing

   $ ./setup_install_server /export/install/ts8_{sparc,ia}

   ---

   Note -

   Do not double-click on this tool because the command must be started in a profile shell, not the shell defined in the File Manager.

   ---

   By default, the Software Installation profile contains the exact pathname for this command, assuming that the role name is called "admin". This profile must be modified if a different mount point is used. To modify a profile, see "How to Modify a Role's Rights".

4. When the pound sign (#) prompt displays, deallocate the CD.

5. Insert the second CD and allocate it.

6. For the second CD, still in the admin role, repeat Step 1 through Step 8.

7. In the File Manager, open the Tools folder on the second CD, one of /cdrom/admin-cdrom_0/trusted_sol_8_sparc/Solaris_8/Tools or /cdrom/admin-cdrom_0/trusted_sol_8_ia/Solaris_8/Tools.

8. From the File menu select Open Terminal.

9. Transfer the files from the second CD to the install server by typing

   $ ./add_to_install_server /export/install/ts8_{sparc,ia}

   ---

   Note -

   Do not double-click on this tool because the command must be started in a profile shell, not the shell defined in the File Manager.

   ---

Set up the Network Install Server for Installation Clients

To complete client installation, editing files and executing commands must be done in the admin role. Follow the instructions for Solaris network installation setup, using the following procedures when needed.

1. To share the server's network install directories so that they are available to the clients, in the admin role at label ADMIN_LOW, do the following:

   1. Run the Share Filesystems action from the System_Admin folder in the Application Manager.

      The Share Filesystems action opens the /etc/dfs/dfstab file.

   2. Enter the network install directory, and any relevant options.

      For example,

      ---

         share -F nfs -o ro,anon=0 -d "netinstall dir" /export/ts8_sparc_install

      ---

   3. Write the file and quit the editor.

   4. Open a terminal to run the share(1M) command to share the file systems.

      For example,

      $ share /export/ts8_sparc_install $ share /jumpstart

   5. Verify that the directories are shared by running the showmount command:

      $ showmount -e export list for install_server: /export/ts8_sparc_install /jumpstart

   6. If it returns the following error: showmount: server: RPC: Program not registered, start the nfs.server daemon, and verify the directories are shared.

      $ /etc/init.d/nfs.server stop $ /etc/init.d/nfs.server start $ showmount -e export list for install_server: /export/ts8_sparc_install /jumpstart

2. To modify or create files in the /etc directory, use the Admin Editor from the System_Admin folder in the Application Manager in order to give the file the correct security attributes.

   See "To Create or Open a File from the Trusted Editor" for how to create or modify a file using the Admin Editor. For example, to create an empty ethers file, do the following:

   1. In the admin role in an ADMIN_LOW workspace, invoke the Admin Editor.

   2. Enter the full path to the file, /etc/ethers.

   3. Once the editor is open, type :wq to save the empty file.

3. Run the Name Service Switch action from the System_Admin folder.

4. Run the Admin Editor action, and enter /etc/nsswitch.conf as the file to edit.

5. Change the ethers, netmasks, and bootparams entries in the file to read as follows:

      ethers: files nisplus dns
   netmasks: files nisplus dns
   bootparams: files nisplus dns

   ---

   Note -

   After adding clients to the network install server, reboot the server before attempting to install the clients over the network.

   ---

Trusted Solaris Modifications to Custom JumpStart

In the Trusted Solaris environment, Custom JumpStart procedures are handled by administrative roles. For an explanation of Custom JumpStart, see "Preparing Custom JumpStart Installations" in Solaris 8 Advanced Installation Guide. Prepare to modify Custom JumpStart procedures with Trusted Solaris security requirements, such as device allocation and task allocation by role.

Factory-installed JumpStart may not be supported by Trusted Solaris software.

Modifications to Custom JumpStart Procedures

The following procedures are slightly different in the Trusted Solaris environment.

The Trusted Solaris environment does not support mounting remote file systems during installation.

Example 9-2 Mount a UFS Filesystem on a Diskette

To create a UFS file system on a diskette to be used for Custom JumpStart, as admin at ADMIN_LOW:

$ mkdir /ts8_jumpstart
$ mount -F ufs /dev/diskette /ts8_jumpstart

Modifications to Custom JumpStart Profiles

Use the Trusted Solaris information in the following table to modify the procedures in "Creating a Profile" in Solaris 8 Advanced Installation Guide.

Use the Trusted Solaris information that follows to modify the procedures in "Testing a Profile" in Solaris 8 Advanced Installation Guide and "pfinstall" in Solaris 8 Advanced Installation Guide.

In the Trusted Solaris environment, testing profiles is handled by the admin role.

How to Use pfinstall to Test a Profile

1. On an installed and configured Trusted Solaris host, log in as a user who can assume the admin role.

2. As admin at label ADMIN_LOW, launch a terminal and see that the pfinstall(1M) command is available in the role's profile shell.

   $ profiles -l | grep pfinstall

   ---

   Note -

   The name profile shell refers to a shell that recognizes Trusted Solaris execution profiles. It does not refer to the machine profiles being tested here.

   ---

3. If the command is not in the profile, the secadmin role must add it to the admin role's rights, and then the admin role launches a new terminal in which to run the command.

   See "How to Modify a Role's Rights" for how to add the pfinstall command to the admin role's rights profile.

Modifications to Custom JumpStart Rules

Use the Trusted Solaris information in the following table to modify the procedures in "Creating the rules File" in Solaris 8 Advanced Installation Guide.

Modifications to Optional Custom JumpStart

Use the Trusted Solaris information that follows to modify the procedures in "Using Optional Custom JumpStart Features" in Solaris 8 Advanced Installation Guide.

Modifications to Begin and Finish Scripts

Use the Trusted Solaris information in the following table to modify the procedures in "Creating Begin Scripts" in Solaris 8 Advanced Installation Guide and "Creating Finish Scripts" in Solaris 8 Advanced Installation Guide.

Trusted Solaris Script Examples

Begin and finish scripts in the Trusted Solaris environment are edited by an administrative role, and run in a profile shell. See the pfexec(1) man page for information on profile shells.

Reboot the Workstation with a Finish Script

Add the last line in the example finish script to every finish script you create.

#!/bin/pfsh /usr/sbin/reboot

Add label_encodings File with a Finish Script

Use the Trusted Solaris information that follows to modify the procedure in "To Add Files With a Finish Script" in Solaris 8 Advanced Installation Guide.

For example, if you are using a custom JumpStart diskette to install Trusted Solaris software, place a copy of the site's label_encodings file into the JumpStart directory on the diskette.

The following finish script copies the file from the JumpStart directory into a workstation's /etc/security/tsol directory during a custom JumpStart installation:

#!/bin/pfsh cp ${SI_CONFIG_DIR}/ label_encodings /a/etc/security/tsol

Set the Root Password With a Finish Script

Use the Trusted Solaris information that follows to modify the procedures in "Setting the System's Root Password With a Finish Script" in Solaris 8 Advanced Installation Guide.

As admin at label ADMIN_LOW, set the variable PASSWD to an encrypted root password obtained from an existing entry in a workstation's /etc/shadow file.

If you set your root password by using a finish script, be sure to safeguard against those who will try to discover the root password from the encrypted password in the finish script.

Modifications to Creating a Disk Configuration File

In the Trusted Solaris environment, configuration files are handled by the admin role. Use the following information to modify the procedures in "Creating Disk Configuration Files" in Solaris 8 Advanced Installation Guide.The Intel architecture procedure also modifies "fdisk" in Solaris 8 Advanced Installation Guide.

SPARC: To Create a SPARC Disk Configuration File

1. Log on as a user who can assume the admin role.

2. As admin at label ADMIN_LOW, launch a terminal and determine the device name for the workstation's disk.

3. Redirect the output of prtvtoc to create the disk configuration file:

   $ prtvtoc /dev/rdsk/device_name > disk_config

IA: To Create an Intel Disk Configuration File

1. As admin at label ADMIN_LOW, redirect the output of the following prtvtoc command to a file.

   $ prtvtoc /dev/rdsk/device_name > file1

2. Save the output of the following fdisk command to a file.

   $ fdisk -R -d -n /dev/rdsk/device_name 2>file2

3. Concatenate the two files to create a disk configuration file.

   $ cat file1 file2 > disk_config

4. Copy the disk configuration file to the JumpStart directory: :

   $ cp disk_config jumpstart_dir_path

Trusted Solaris Differences for a JumpStart Example

Use the Trusted Solaris information that follows to modify the example in "Example of Setting Up and Installing Solaris Software With Custom JumpStart" in Solaris 8 Advanced Installation Guide.

In the Trusted Solaris environment, the Solaris JumpStart marketing and engineering example requires a user to assume the admin role.

• The site uses NIS+. The Ethernet addresses, IP addresses, and host names are in NIS+ tables.

• JumpStart information must use "None" for the naming service. Hosts installed by JumpStart are cliented after JumpStart finishes.

• All commands are done by a particular role at a particular label, usually ADMIN_LOW. To execute a command, the role must have the command at that label in its Rights Profile.

• All directories are created by the admin role at the label ADMIN_LOW, as in:

  $ cp -r /export/install/jumpstart_sample /jumpstart

• To create a shared directory, in the admin role at label ADMIN_LOW follow the procedure in "How to Share a File System" to create a vfstab entry, as in:

  ---

     share -F nfs -o ro,anon=0 /jumpstart

  ---

• To create a profile, the security administrator in the admin role at label ADMIN_LOW uses the Admin Editor action.

• To edit the rules file, the admin role at the label ADMIN_LOW uses the Admin Editor action.

• To execute the check script, the admin role at the label ADMIN_LOW runs the check(1M) script, as in:

  $ cd /jumpstart $ ./check

Set up the engineering systems for installation

On the install server, the admin role at the label ADMIN_LOW uses the add_install_client(1M) command:

$ cd /export/install
$ ./add_install_client -c server_1:/jumpstart host_eng1 sun4u
$ ./add_install_client -c server_1:/jumpstart host_eng2 sun4u
	.

Set up the marketing systems for installation

An administrator in the admin role at label ADMIN_LOW then uses the setup_install_server(1M) command that copies the boot software from the CD to the marketing server.

$ cd /cdrom/cdrom0/s0/Trusted_Solaris_8/Tools
$ ./setup_install_server -b /marketing/boot-dir sun4c

At label ADMIN_LOW, the admin role uses the add_install_client command on the marketing group's boot server.

$ cd /marketing/boot-dir
$ ./add_install_client -s server_1:/export/install \
-c server_1:/jumpstart host_mkt1 sun4c
$ ./add_install_client -s server_1:/export/install \
-c server_1:/jumpstart host_mkt2 sun4c	...