test

Trusted Solaris Installation and Configuration

Setting Up Network Installation

For an overall view of the differences between Trusted Solaris and Solaris installation, see "Trusted Solaris Modifications to Network Installation". See the "Preparing to Install Solaris Software Over the Network" in Solaris 8 Advanced Installation Guide for the installation procedures themselves.

Steps 

Where Described 

1. Copy installation CDs to hard disk. 

"Give Mounted Media All Allowed Privileges"

"Allocate the CD-ROM Device"

"Modify Permissions of Mount Point Parent"

"Load Trusted Solaris Images from CDs"

2. Share the install directory. 

"Share the Network Install Directory"

3. Add client information and reboot. 

"Add Client Information to the Install Server"

4. Boot the client machine. 

"Boot Over the Network or with Custom Files"

5. Configure it. 

"Client Configuration Tasks"

Give Mounted Media All Allowed Privileges

Users in administrative roles copy the Trusted Solaris CD-ROMs to a server's hard disk. The secadmin role gives all allowed privileges to the CD-ROM device and modifies profiles where necessary. The admin role allocates the device, changes the permissions on the parent of the mount point, and copies the software to the install server.

  1. Log in as a user who can assume the secadmin role and assume it.

  2. Open the Admin Editor from the System_Admin folder and type /etc/rmmount.conf in the file name field.

  3. Assign all allowed privileges to mounted removable media in the /etc/rmmount.conf file, as in:


    mount * hsfs udfs ufs -o nosuid allowed=all

  4. Write the file with :wq! and exit the editor.

Allocate the CD-ROM Device

  1. Log in as a user who can assume the admin role and assume it.

  2. In the admin role at label ADMIN_LOW, open the Device Allocation Manager, allocate the CD-ROM drive and mount it.

    After the CD-ROM has been mounted, a File Manager pops up showing the mount point of the CD-ROM.

  3. If a File Manager does not appear, bring one up from the Front Panel and navigate to the CD-ROM mount point.

    For Trusted Solaris software, the mount point should be one of:

    • /cdrom/admin-cdrom_0/trusted_sol_8_sparc

    • /cdrom/admin-cdrom_0/trusted_sol_8_ia

  4. In the File Manager, highlight /cdrom/admin-cdrom_0, the parent of the mount point.

  5. From the Selected menu, choose Properties.

    Note that the directory, named CD-ROM_FOLDER, has mode 700, so it is not searchable. The following procedure will fix that.

Modify Permissions of Mount Point Parent

  1. In the File Manager, click the Show Access Control List button, then Add ...

  2. Highlight the Mask entry and click Change.

  3. Change the Mask to Read and Execute, and click Change.

  4. Click Add..., and enter root in the User field, giving it Read and Execute.

  5. Click Add, then click OK to exit the dialog.

  6. Leave the File Manager up, available for the installation setup commands.

Load Trusted Solaris Images from CDs

  1. In the File Manager, open the Tools folder, from one of the following:

    • /cdrom/admin-cdrom_0/trusted_sol_8_sparc/Trusted_Solaris_8/Tools

    • /cdrom/admin-cdrom_0/trusted_sol_8_ia/Trusted_Solaris_8/Tools

  2. From the File menu select Open Terminal.

  3. Still in the admin role, transfer the files from the first CD to the install server by typing


    $ ./setup_install_server /export/install/ts8_{sparc,ia}

    Note -

    Do not double-click on this tool because the command must be started in a profile shell, not the shell defined in the File Manager.

    By default, the Software Installation profile contains the exact pathname for this command. The secadmin role must modify this profile if a different mount point is used. To modify a profile, see "Modifying a Role's Rights".

    Example 7-1 Admin Role Verifying that a Command is Available

    If the commands add_install_client and rm_install_client are in the admin role's profile, the profiles(1) command should display something like the following for a disk image:


    $ profiles -l | grep install_client
/export/install/ts8_sparc/add_install_client: 
  4,5,6,10,11,12,17,30,32,33,35,36,39,52,55,57,61,68,69
/export/install/ts8_sparc/rm_install_client:
  4,5,6,10,11,12,17,30,32,33,35,36,39,52,55,57,61,68,69

  4. When the pound sign (#) prompt displays, deallocate the CD.

  5. Insert the second CD, allocate it and mount it.

  6. For the second CD, still in the admin role, repeat Step 4 through Step 6 of the procedure "Modify Permissions of Mount Point Parent".

  7. In the File Manager, open the Tools folder on the second CD, one of the following:

    • /cdrom/admin-cdrom_0/trusted_sol_8_sparc/Solaris_8/Tools

    • /cdrom/admin-cdrom_0/trusted_sol_8_ia/Solaris_8/Tools

  8. From the File menu select Open Terminal.

  9. Transfer the files from the second CD to the install server by typing


    $ ./add_to_install_server /export/install/ts8_{sparc,ia}

    Note -

    Do not double-click on this tool because the command must be started in a profile shell, not the shell defined in the File Manager.

  10. Deallocate the second CD and remove it.

Share the Network Install Directory

To complete network installation setup requires a user in the admin role. Follow the instructions for Solaris network installation setup, using the following procedures when needed.

  1. In the admin role at ADMIN_LOW, start the Solaris Management Console.


    $ smc &

  2. Select the this-host: Scope=Files, Policy=TSOL toolbox.

  3. Navigate to the Mounts and Shares tool in the Solaris Management Console to share the network install directory for the Trusted Solaris image.

    If you are unsure of the steps, see "(Optional) Share File Systems".

  4. Double-click the Properties tab to modify the properties of the shared file system.

  5. Enter ro, anon=0, and "netinstall dir" for the network install directory, for example, for /export/ts8_sparc_install.

Add Client Information to the Install Server

To modify or create files in the /etc directory, use the Admin Editor from the System_Admin folder to give the file the correct security attributes.

See "To Create or Open a File from the Trusted Editor" for how to create or modify a file using the Admin Editor.

  1. To create an empty ethers file, in the admin role at ADMIN_LOW, invoke the Admin Editor.

  2. Enter the full path to the file, /etc/ethers.

  3. Once the editor is open, type :wq to save the empty file.

  4. In a terminal, change the file permissions to 644.


    $ chmod 644 /etc/ethers

  5. Run the Name Service Switch action from the System_Admin folder.

  6. Change the ethers, netmasks, and bootparams entries in the file to read as follows: 

    ethers: files name-service dns
netmasks: files name-service dns
bootparams: files name-service dns

    The variable name-service is one of nis or nisplus.

  7. In the role admin at ADMIN_LOW, run the add_install_client command to add client information to the OS server.

    See the add_install_client(1M) for details.

  8. Reboot the install server before attempting to install clients over the network.

Trusted Solaris Modifications to Network Installation

Trusted Solaris software modifies network installation commands and procedures that require greater security. For example, the Volume Manager adds a mounting-user directory when mounting devices in the Trusted Solaris environment.

Table 7-1 Trusted Solaris Differences in Network Installation

Solaris Software  

Trusted Solaris Software 

You can log in as root. 

There is no superuser. You log in as a user who can assume the root role, or as a user who can assume the admin or secadmin role, depending on the task. Then, assume the role to perform the task. 

Processes and files do not have a label. 

All processes and files are labeled. Commands and actions are run at a particular label. Most administrative tasks are run at the label ADMIN_LOW.

Administrators can often use a command line interface, even if a corresponding GUI equivalent exists. 

Many administrative commands are run from a GUI, which calls checking and synchronizing functions. 

Administrators can run an administrative command from a CD-ROM or diskette. 

Commands that are on a diskette or CD-ROM, or are accessible from an NFS mount, may need to be added to the admin role's profile before they can be run. 

Allows you to use a CD-ROM or diskette without allocating it. 

Requires you to allocate a peripheral device at a particular label before its use. Before removing the medium, you must deallocate it. 

Modifications to Network Installation Commands

The following commands and actions are used when installing Solaris software or Trusted Solaris software over a network, and their use is modified in the Trusted Solaris environment. The following listing describes the additional procedures or security requirements. Commands that do not require a change in procedure are not listed. See the "Preparing to Install Solaris Software Over the Network" in Solaris 8 Advanced Installation Guide for the installation procedures themselves.

Table 7-2 Modified Network Commands

Network Command or GUI 

Trusted Solaris Modification in its Use 

setup_install_server(1M)

add_install_client(1M)

add_to_install_server(1M)

rm_install_client(1M)

You must be in the admin role, at label ADMIN_LOW, in a terminal where the command is in a profile assigned to the admin role.

If the admin role does not have this /pathname/*install* command in its assigned profiles, the secadmin role, at label ADMIN_LOW, must add it to the Custom Admin Role profile.

For the procedure, see "Modifying a Role's Rights".

mount(1M)

The admin role, at label ADMIN_LOW, runs this command.

If you are mounting a CD-ROM or diskette on an installed system, the admin role must allocate the device at a particular label, usually ADMIN_LOW. When the medium is removed, the device must be deallocated.