JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
Trusted Extensions Configuration and Administration     Oracle Solaris 11.1 Information Library
search filter icon
search icon

Document Information


Part I Initial Configuration of Trusted Extensions

1.  Security Planning for Trusted Extensions

2.  Configuration Roadmap for Trusted Extensions

3.  Adding the Trusted Extensions Feature to Oracle Solaris (Tasks)

4.  Configuring Trusted Extensions (Tasks)

5.  Configuring LDAP for Trusted Extensions (Tasks)

Part II Administration of Trusted Extensions

6.  Trusted Extensions Administration Concepts

7.  Trusted Extensions Administration Tools

8.  Security Requirements on a Trusted Extensions System (Overview)

9.  Performing Common Tasks in Trusted Extensions

10.  Users, Rights, and Roles in Trusted Extensions (Overview)

User Security Features in Trusted Extensions

Administrator Responsibilities for Users

System Administrator Responsibilities for Users

Security Administrator Responsibilities for Users

Decisions to Make Before Creating Users in Trusted Extensions

Default User Security Attributes in Trusted Extensions

label_encodings File Defaults

policy.conf File Defaults in Trusted Extensions

Configurable User Attributes in Trusted Extensions

Security Attributes That Must Be Assigned to Users

Security Attribute Assignment to Users in Trusted Extensions

.copy_files and .link_files Files

11.  Managing Users, Rights, and Roles in Trusted Extensions (Tasks)

12.  Remote Administration in Trusted Extensions (Tasks)

13.  Managing Zones in Trusted Extensions

14.  Managing and Mounting Files in Trusted Extensions

15.  Trusted Networking (Overview)

16.  Managing Networks in Trusted Extensions (Tasks)

17.  Trusted Extensions and LDAP (Overview)

18.  Multilevel Mail in Trusted Extensions (Overview)

19.  Managing Labeled Printing (Tasks)

20.  Devices in Trusted Extensions (Overview)

21.  Managing Devices for Trusted Extensions (Tasks)

22.  Trusted Extensions Auditing (Overview)

23.  Software Management in Trusted Extensions

A.  Site Security Policy

Creating and Managing a Security Policy

Site Security Policy and Trusted Extensions

Computer Security Recommendations

Physical Security Recommendations

Personnel Security Recommendations

Common Security Violations

Additional Security References

B.  Configuration Checklist for Trusted Extensions

Checklist for Configuring Trusted Extensions

C.  Quick Reference to Trusted Extensions Administration

Administrative Interfaces in Trusted Extensions

Oracle Solaris Interfaces Extended by Trusted Extensions

Tighter Security Defaults in Trusted Extensions

Limited Options in Trusted Extensions

D.  List of Trusted Extensions Man Pages

Trusted Extensions Man Pages in Alphabetical Order

Oracle Solaris Man Pages That Are Modified by Trusted Extensions



Security Attributes That Must Be Assigned to Users

The security administrator can modify the security attributes for new users. For information about the files that contain the default values, see Default User Security Attributes in Trusted Extensions. The following table shows the security attributes that can be assigned to users and the effect of each assignment.

Table 10-2 Security Attributes That Are Assigned After User Creation

User Attribute
Location of Default Value
Is Action Required
Effect of Assignment
User has password
User can assume a role
policy.conf file
User has additional authorizations
Rights Profiles
policy.conf file
User has additional rights profiles
label_encodings file
User has different default label or accreditation range
policy.conf file
User has different set of privileges
Account Usage
policy.conf file
User has different setting for computer when it is idle
User is audited differently from the system defaults

Security Attribute Assignment to Users in Trusted Extensions

The security administrator assigns security attributes to users after the user accounts are created. If you have set up correct defaults, your next step is to assign security attributes only for users who need exceptions to the defaults.

When assigning security attributes to users, consider the following information:

Assigning Passwords

The system administrator can assign passwords to user accounts during account creation. After this initial assignment, the security administrator or the user can change the password.

As in Oracle Solaris, users can be forced to change their passwords at regular intervals. The password aging options limit how long any intruder who is able to guess or steal a password could potentially access the system. Also, establishing a minimum length of time to elapse before changing a password prevents a user with a new password from reverting immediately to the old password. For details, see the passwd(1) man page.

Note - The passwords for users who can assume roles must not be subject to any password aging constraints.

Assigning Roles

A user is not required to have a role. A user can be assigned more than one role if doing so is consistent with your site's security policy.

Assigning Authorizations

As in the Oracle Solaris OS, assigning authorizations to a user adds those authorizations to existing authorizations. Best practice is to add the authorizations to a rights profile, then assign the profile to the user.

Assigning Rights Profiles

As in the Oracle Solaris OS, the order of rights profiles is important. With the exception of authorizations, the profile mechanism uses the value of the first instance of an assigned security attribute. For more information, see Order of Search for Assigned Security Attributes in Oracle Solaris 11.1 Administration: Security Services.

You can use the sorting order of profiles to your advantage. If you want a command to run with different security attributes from those attributes that are defined for the command in an existing profile, create a new profile with the preferred assignments for the command. Then, insert that new profile before the existing profile.

Note - Do not assign rights profiles that include administrative commands to a regular user. The rights profile cannot work because a regular user cannot enter the global zone.

Changing Privilege Default

The default privilege set can be too liberal for many sites. To restrict the privilege set for any regular user on a system, change the policy.conf file setting. To change the privilege set for individual users, see How to Restrict a User's Set of Privileges.

Changing Label Defaults

Changing a user's label defaults creates an exception to the user defaults in the label_encodings file.

Changing Audit Defaults

As in the Oracle Solaris OS, assigning audit classes to a user modifies the user's preselection mask. For more information about auditing, see Part VII, Auditing in Oracle Solaris, in Oracle Solaris 11.1 Administration: Security Services and Chapter 22, Trusted Extensions Auditing (Overview).

.copy_files and .link_files Files

In Trusted Extensions, files are automatically copied from the skeleton directory only into the zone that contains the account's minimum label. To ensure that zones at higher labels can use startup files, either the user or the administrator must create the files .copy_files and .link_files.

The Trusted Extensions files .copy_files and .link_files help to automate the copying or linking of startup files into every label of an account's home directory. Whenever a user creates a workspace at a new label, the updatehome command reads the contents of .copy_files and .link_files at the account's minimum label. The command then copies or links every listed file into the higher-labeled workspace.

The .copy_files file is useful when a user wants a slightly different startup file at different labels. Copying is preferred, for example, when users use different mail aliases at different labels. The .link_files file is useful when a startup file should be identical at any label that it is invoked. Linking is preferred, for example, when one printer is used for all labeled print jobs. For example files, see How to Configure Startup Files for Users in Trusted Extensions.

The following lists some startup files that you might want users to be able to link to higher labels or to copy to higher labels: