How to Control Access to a Single Console by Using Rights Profiles

1. Restrict access to a domain console by enabling console authorization checking.

   primary# svccfg -s vntsd setprop vntsd/authorization = true
   primary# svcadm refresh vntsd
   primary# svcadm restart vntsd

2. Add an authorization for a single domain to the authorization description database.

   The following example entry adds the authorization for a domain console:

   solaris.vntsd.console-domain:::Access domain Console::

3. Create a rights profile with an authorization to access a specific domain console.
   • Oracle Solaris 10 OS: Edit the /etc/security/prof_attr file.

     domain Console:::Access domain
     Console:auths=solaris.vntsd.console-domain

     This entry must be on a single line.

   • Oracle Solaris 11 OS: Use the profiles command to create a new profile.

     primary# profiles -p "domain Console" \
     'set desc="Access domain Console";
     set auths=solaris.vntsd.console-domain'

4. Assign the rights profile to a user.

   The following commands assign the profile to a user:

   • Oracle Solaris 10 OS: Assign the rights profile.

     primary# usermod -P "All,Basic Solaris User,domain Console" username

     Note that the All and Basic Solaris User profiles are required.

   • Oracle Solaris 11 OS: Assign the rights profile.

     primary# usermod -P +"domain Console" username