smtnrhtp(1M) (Solaris Trusted Extensions Reference Manual)

Solaris Trusted Extensions Reference Manual

smtnrhtp(1M)

NAME

smtnrhtp – manage entries in the trusted network template database

Synopsis

/usr/sadm/bin/smtnrhtp subcommand [auth_args] -- [subcommand_args]

Description

The smtnrhtp command adds, modifies, deletes, and lists entries in the tnrhtp database.

smtnrhtp subcommands are:

add: Adds a new entry to the tnrhtp database. To add an entry, the administrator must have the solaris.network.security.read and solaris.network.security.write authorizations.
modify: Modifies an entry in the tnrhtp database. To modify an entry, the administrator must have the solaris.network.security.read and solaris.network.security.write authorizations.
delete: Deletes an entry from tnrhtp database. To delete an entry, the administrator must have the solaris.network.security.read and solaris.network.security.write authorizations.
list: Lists entries in the tnrhtp database. To list an entry, the administrator must have the solaris.network.security.read authorizations.

Options

The smtnrhtp authentication arguments, auth_args, are derived from the smc arg set and are the same regardless of which subcommand you use. The smtnrhtp command requires the Solaris Management Console to be initialized for the command to succeed (see smc(1M)). After rebooting the Solaris Management Console server, the first smc connection can time out, so you might need to retry the command.

The subcommand-specific options, subcommand_args, must be preceded by the -- option.

`auth_args`

The valid auth_args are -D, -H, -l, -p, -r, and -u; they are all optional. If no auth_args are specified, certain defaults will be assumed and the user might be prompted for additional information, such as a password for authentication purposes. These letter options can also be specified by their equivalent option words preceded by a double dash. For example, you can use either -D or --domain.

-D | --domain domain

Specifies the default domain that you want to manage. The syntax of domain=type:/host_name/domain_name, where type is dns, ldap, or file; host_name is the name of the server; and domain_name is the name of the domain you want to manage.

If you do not specify this option, the Solaris Management Console assumes the file default domain on whatever server you choose to manage, meaning that changes are local to the server. Toolboxes can change the domain on a tool-by-tool basis; this option specifies the domain for all other tools.

-H | --hostname host_name:port

Specifies the host_name and port to which you want to connect. If you do not specify a port, the system connects to the default port, 898. If you do not specify host_name:port, the Solaris Management Console connects to the local host on port 898.

-l | --rolepassword role_password

Specifies the password for the role_name. If you specify a role_name but do not specify a role_password, the system prompts you to supply a role_password. Passwords specified on the command line can be seen by any user on the system, hence this option is considered insecure.

-p | --password password

Specifies the password for the user_name. If you do not specify a password, the system prompts you for one. Passwords specified on the command line can be seen by any user on the system, hence this option is considered insecure.

-r | --rolename role_name

Specifies a role name for authentication. If you do not specify this option, no role is assumed.

-u | --username user_name

Specifies the user name for authentication. If you do not specify this option, the user identity running the console process is assumed.

--

This option is required and must always follow the preceding options. If you do not enter the preceding options, you must still enter the -- option.

`subcommand_args`

Note: Descriptions and other arg options that contain white spaces must be enclosed in double quotes.

-h: Displays the command's usage statement.
-n templatename: Specifies the name of the template.
-t hosttype: Specifies the hosttype of the new host. Valid values are unlabeled and cipso.
-x doi=doi-value: Specifies the DOI value.
-x max=maximum-label: Specifies the maximum label. Values can be a hex value or string (such as admin_high).
-x min=minimum-label: Specifies the minimum label. Values can be a hex value or string (such as admin_low).
-x label=default-label: Specifies the default label when the host type is unlabeled. This option does not apply if hosttype is CIPSO. Values can be a hex value or string (such as admin_low).
-x slset=l1,l2,l3,l4: Specifies a set of sensitivity labels. You can specify up to four label values, separated by commas. Values can be a hex value or string (such as admin_low).

One of the following sets of arguments must be specified for subcommand add:
-n template name (
)
One of the following sets of arguments must be specified for subcommand modify:
-n template name (
)
Note: If the host type is changed, all options for the new host type must be specified.
One of the following sets of arguments must be specified for subcommand delete:
-n templatename | -h
The following argument can be specified for subcommand list:
-n templatename | -h

Examples

Example 1 Adding a New Entry to the Network Template Database

The admin role connects to port 898 of the LDAP server and creates the unlabeled_ntk entry in the tnrhtp database. The new template is assigned a host type of unlabeled, a domain of interpretation of 1, minimum label of public, maximum label of restricted, and a default label of needtoknow. The administrator is prompted for the admin password.

$ /usr/sadm/bin/smtnrhtp \
add -D ldap:directoryname -H servername:898 -- \
-n unlabeled_ntk -t unlabeled -x DOI=1 \
-x min=public -x max=restricted -x label="need to know"

Exit Status

The following exit values are returned:

0: Successful completion.
1: Invalid command syntax. A usage message displays.
2: An error occurred while executing the command. An error message displays.

Files

The following files are used by the smtnrhtp command:

/etc/security/tsol/tnrhtp: Trusted network remote-host templates. See tnrhtp(4).

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWmgts