Logical Domains 1.2 Administration Guide

Previous: Downloading Logical Domains Manager and Solaris Security Toolkit
Next: Using JumpStart to Install the Logical Domains Manager 1.2 and Solaris Security Toolkit 4.2 Software

Installing the Logical Domains Manager and Solaris Security Toolkit Software Automatically

If you use the install-ldm installation script, you have several choices to specify how you want the script to run. Each choice is described in the procedures that follow.

Using the install-ldm script with no options does the following automatically:
- Checks that the Solaris OS release is Solaris 10 5/09 OS at a minimum
- Verifies that the package subdirectories SUNWldm/ and SUNWjass/ are present
- Verifies that the prerequisite Solaris Logical Domains driver packages, SUNWldomr and SUNWldomu, are present
- Verifies that the SUNWldm and SUNWjass packages have not been installed
  
  Note –
  If the script does detect a previous version of SUNWjass during installation, you must remove it. You do not need to undo any previous hardening of your Solaris OS.
- Installs the Logical Domains Manager 1.2 software (SUNWldm package)
- Installs the Solaris Security Toolkit 4.2 software including required patches (SUNWjass package)
- Verifies that all packages are installed
- Enables the Logical Domains Manager daemon, ldmd
- Hardens the Solaris OS on the control domain with the Solaris Security Toolkit ldm_control-secure.driver or one of the other drivers ending in -secure.driver that you select.
Using the install-ldm script with option -d allows you to specify a Solaris Security Toolkit driver other than a driver ending with -secure.driver. This option automatically performs all the functions listed in the preceding choice and hardens the Solaris OS on the control domain with the Solaris Security Toolkit customized driver that you specify; for example, the server-secure-myname.driver.
Using the install-ldm script with option -d and specifying none specifies that you do not want to harden the Solaris OS running on your control domain by using the Solaris Security Toolkit. This option automatically performs all the functions except hardening listed in the preceding choices. Bypassing the use of the Solaris Security Toolkit is not suggested and should only be done when you intend to harden your control domain using an alternate process.
Using the install-ldm script with option -p specifies that you only want to perform the post-installation actions of enabling the Logical Domains Manager daemon (ldmd) and running the Solaris Security Toolkit. For example, you would use this option if the SUNWldm and SUNWjass packages are preinstalled on your server. See Enable the Logical Domains Manager Daemon and Run the Solaris Security Toolkit Only

Install With No Special Options

Run the install-ldm installation script with no options.

The installation script is part of the SUNWldm package and is in the Install subdirectory.

# Install/install-ldm

If one or more packages are previously installed, you receive this message.

# Install/install-ldm
ERROR: One or more packages are already installed: SUNWldm SUNWjass.
If packages SUNWldm.v and SUNWjass are factory pre-installed, run
install-ldm -p to perform post-install actions.  Otherwise remove the
package(s) and restart install-ldm.

If you want to perform post-installation actions only, go to Enable the Logical Domains Manager Daemon and Run the Solaris Security Toolkit Only.

If the process is successful, you receive messages similar to those in the following examples.

Example 3–1 shows a successful run of the install-ldm script if you choose the following default security profile:

a) Hardened Solaris configuration for LDoms (recommended)
Example 3–2 shows a successful run of the install-ldm script if you choose the following security profile:

c) Your custom-defined Solaris security configuration profile

The drivers that are displayed for you to choose are drivers ending with -secure.driver. If you write a customized driver that does not end with -secure.driver, you must specify your customized driver with the install-ldm -d option. (See Install With a Customized Hardening Driver.)

Example 3–1 Output From Hardened Solaris Configuration for LDoms

# Install/install-ldm
Welcome to the LDoms installer.
 
You are about to install the domain manager package that will enable
you to create, destroy and control other domains on your system. Given
the capabilities of the domain manager, you can now change the security
configuration of this Solaris instance using the Solaris Security
Toolkit.
 
Select a security profile from this list:
 
a) Hardened Solaris configuration for LDoms (recommended)
b) Standard Solaris configuration
c) Your custom-defined Solaris security configuration profile
 
Enter a, b, or c [a]: a
The changes made by selecting this option can be undone through the
Solaris Security Toolkit's undo feature. This can be done with the
`/opt/SUNWjass/bin/jass-execute -u'  command.
 
Installing LDoms and Solaris Security Toolkit packages.
pkgadd -n -d "/var/tmp/install/Product/Logical_Domain_Manager" -a pkg_admin SUNWldm.v
Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
 
Installation of <SUNWldm> was successful.
pkgadd -n -d "/var/tmp/install/Product/Solaris_Security_Toolkit" -a pkg_admin SUNWjass
Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
 
Installation of <SUNWjass> was successful. 
 
Verifying that all packages are fully installed.  OK.
Enabling services: svc:/ldoms/ldmd:default
Running Solaris Security Toolkit 4.2.0 driver ldm_control-secure.driver.
Please wait. . . 
/opt/SUNWjass/bin/jass-execute -q -d ldm_control-secure.driver
Executing driver, ldm_control-secure.driver
Solaris Security Toolkit hardening executed successfully; log file
/var/opt/SUNWjass/run/20070208142843/jass-install-log.txt.  It will not
take effect until the next reboot.  Before rebooting, make sure SSH or
the serial line is setup for use after the reboot.

Example 3–2 Output From Choosing Customized Configuration Profile

# Install/install-ldm
Welcome to the LDoms installer.
 
You are about to install the domain manager package that will enable
you to create, destroy and control other domains on your system. Given
the capabilities of the domain manager, you can now change the security
configuration of this Solaris instance using the Solaris Security
Toolkit.
 
Select a security profile from this list:
 
a) Hardened Solaris configuration for LDoms (recommended)
b) Standard Solaris configuration
c) Your custom-defined Solaris security configuration profile
 
Enter a, b, or c [a]: c
Choose a Solaris Security Toolkit .driver configuration profile from
this list
1) ldm_control-secure.driver
2) secure.driver
3) server-secure.driver
4) suncluster3x-secure.driver
5) sunfire_15k_sc-secure.driver
 
Enter a number 1 to 5: 2
The driver you selected may not perform all the LDoms-specific
operations specified in the LDoms Administration Guide.
Is this OK (yes/no)? [no] y
The changes made by selecting this option can be undone through the
Solaris Security Toolkit's undo feature. This can be done with the
`/opt/SUNWjass/bin/jass-execute -u' command.
 
Installing LDoms and Solaris Security Toolkit packages.
pkgadd -n -d "/var/tmp/install/Product/Logical_Domain_Manager" -a pkg_admin SUNWldm.v
Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
 
Installation of <SUNWldm> was successful.
pkgadd -n -d "/var/tmp/install/Product/Solaris_Security_Toolkit" -a pkg_admin SUNWjass
Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
 
Installation of <SUNWjass> was successful. 
 
Verifying that all packages are fully installed.  OK.
Enabling services: svc:/ldoms/ldmd:default
Running Solaris Security Toolkit 4.2.0 driver secure.driver.
Please wait. . . 
/opt/SUNWjass/bin/jass-execute -q -d secure.driver
Executing driver, secure.driver
Solaris Security Toolkit hardening executed successfully; log file
/var/opt/SUNWjass/run/20070102142843/jass-install-log.txt.  It will not
take effect until the next reboot.  Before rebooting, make sure SSH or
the serial line is setup for use after the reboot.

Install With a Customized Hardening Driver

Run the install-ldm installation script with the -d option to specify a Solaris Security Toolkit customized hardening driver; for example, server-secure-myname.driver.

The installation script is part of the SUNWldm package and is in the Install subdirectory.
# Install/install-ldm -d server-secure-myname.driver
If the process is successful, you receive messages similar to those in the following example:

Example 3–3 Output From Successful Run of the install-ldm -d Script

# Install/install-ldm -d server-secure.driver
The driver you selected may not perform all the LDoms-specific
operations specified in the LDoms Administration Guide.
Installing LDoms and Solaris Security Toolkit packages.
pkgadd -n -d "/var/tmp/install/Product/Logical_Domain_Manager" -a pkg_admin SUNWldm.v
Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
 
Installation of <SUNWldm> was successful.
pkgadd -n -d "/var/tmp/install/Product/Solaris_Security_Toolkit" -a pkg_admin SUNWjass
Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
 
Installation of <SUNWjass> was successful. 
 
Verifying that all packages are fully installed.  OK.
Enabling services: svc:/ldoms/ldmd:default
Running Solaris Security Toolkit 4.2.0 driver server-secure-myname.driver.
Please wait. . . 
/opt/SUNWjass/bin/jass-execute -q -d server-secure-myname.driver
Executing driver, server-secure-myname.driver
Solaris Security Toolkit hardening executed successfully; log file
/var/opt/SUNWjass/run/20061114143128/jass-install-log.txt.  It will not
take effect until the next reboot.  Before rebooting, make sure SSH or
the serial line is setup for use after the reboot.

Install and Do Not Harden Your System

Run the install-ldm installation script with the -d none option to specify not to harden your system using a Solaris Security Toolkit driver.

The installation script is part of the SUNWldm package and is in the Install subdirectory.
# Install/install-ldm -d none
If the process is successful, you receive messages similar to those in the following example:

Example 3–4 Output From Successful Run of the install-ldm -d none Script

# Install/install-ldm -d none
Installing LDoms and Solaris Security Toolkit packages.
pkgadd -n -d "/var/tmp/install/Product/Logical_Domain_Manager" -a pkg_admin SUNWldm.v
Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
 
Installation of <SUNWldm> was successful.
pkgadd -n -d "/var/tmp/install/Product/Solaris_Security_Toolkit" -a pkg_admin SUNWjass
Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
 
Installation of <SUNWjass> was successful. 
 
Verifying that all packages are fully installed.  OK.
Enabling services: svc:/ldoms/ldmd:default
Solaris Security Toolkit was not applied. Bypassing the use of the
Solaris Security Toolkit is not recommended and should only be
performed when alternative hardening steps are to be taken.

Enable the Logical Domains Manager Daemon and Run the Solaris Security Toolkit Only

You might use this option if the SUNWldm and SUNWjass packages are preinstalled on your server and you want to perform the post-installation actions of enabling the Logical Domains Manager daemon (ldmd) and running the Solaris Security Toolkit.

Run the install-ldm installation script with the -p option to perform only the post-installation actions of enabling ldmd and running the Solaris Security Toolkit to harden your system.

# Install/install-ldm -p
Verifying that all packages are fully installed.  OK.
Enabling services: svc:/ldoms/ldmd:default
Running Solaris Security Toolkit 4.2.0 driver ldm_control-secure.driver.
Please wait. . .
/opt/SUNWjass/bin/jass-execute -q -d ldm_control-secure.driver
Solaris Security Toolkit hardening executed successfully; log file
var/opt/SUNWjass/run/20070515140944/jass-install-log.txt.  It will not
take effect until the next reboot.  Before rebooting, make sure SSH or
the serial line is setup for use after the reboot.