Methods for Administering Remote Systems in Trusted Extensions

In Trusted Extensions, you must use the ssh protocol with host-based authentication to reach and administer the remote system. Host-based authentication enables an identically-named user account to assume a role on the remote Trusted Extensions.

When host-based authentication is used, the ssh client sends both the original username and the role name to the remote system, the server. With this information, the server can pass sufficient content to the pam_roles module to enable role assumption without the user account logging in to the server.

The following methods of remote administration are possible in Trusted Extensions:

• Administer from a Trusted Extensions system – For the most secure remote administration, both systems assign their peer to a CIPSO security template. See Example 12-1.

• Administer from an unlabeled system – If administration by a Trusted Extensions system is not practical, the network protocol policy can be relaxed by specifying the allow_unlabeled option for the pam_tsol_account module in the pam.conf file.

  If this policy is relaxed, the default security template must be changed so that arbitrary systems cannot reach the global zone. The admin_low template should be used sparingly, and the wildcard address 0.0.0.0 must not default to the ADMIN_LOW label. For details, see How to Limit the Hosts That Can Be Contacted on the Trusted Network.

In either administrative scenario, to use the root role for remote login, you must relax PAM policy by specifying the allow_remote option for the pam_roles module.

Typically, administrators use the ssh command to administer remote systems from the command line. With the -X option, Trusted Extensions administrative GUIs can be used.

Also, you can configure the remote Trusted Extensions with the Xvnc server. Then, a Virtual Network Computing (VNC) connection can be used to display the remote multilevel desktop and administer the system. See How to Configure a Trusted Extensions System With Xvnc for Remote Access.