1. Security Planning for Trusted Extensions
2. Configuration Roadmap for Trusted Extensions
3. Adding Trusted Extensions Software to the Solaris OS (Tasks)
Initial Setup Team Responsibilities
Installing or Upgrading the Solaris OS for Trusted Extensions
Collecting Information and Making Decisions Before Enabling Trusted Extensions
Collect System Information Before Enabling Trusted Extensions
Make System and Security Decisions Before Enabling Trusted Extensions
Enabling the Trusted Extensions Service
4. Configuring Trusted Extensions (Tasks)
5. Configuring LDAP for Trusted Extensions (Tasks)
6. Configuring a Headless System With Trusted Extensions (Tasks)
B. Using CDE Actions to Install Zones in Trusted Extensions
The choice of Solaris installation options can affect the use and security of Trusted Extensions:
To properly support Trusted Extensions, you must install the underlying Solaris OS securely. For Solaris installation choices that affect Trusted Extensions, see Install a Solaris System to Support Trusted Extensions.
If you have been using the Solaris OS, check your current configuration against the requirements for Trusted Extensions. For configuration choices that affect Trusted Extensions, see Prepare an Installed Solaris System for Trusted Extensions.
This task applies to fresh installations of the Solaris OS. If you are upgrading, see Prepare an Installed Solaris System for Trusted Extensions.
The choices follow the order of Solaris installation questions. Installation questions that are not mentioned in this table do not affect Trusted Extensions.
|
This task applies to Solaris systems that have been in use, and on which you plan to run Trusted Extensions. Also, to run Trusted Extensions on an upgraded Solaris system, follow this procedure. Other tasks that might modify an installed Solaris system can be done during Trusted Extensions configuration.
Trusted Extensions cannot be enabled in some Solaris environments:
If your system is part of a cluster, Trusted Extensions cannot be enabled on the system.
The enabling of Trusted Extensions in an alternate boot environment (BE) is not supported. Trusted Extensions can only be enabled in the current boot environment.
Or, you can re-install the Solaris OS. If you are going to re-install the Solaris OS, follow the instructions in Install a Solaris System to Support Trusted Extensions.
Trusted Extensions use branded zones.
Administration tools in Trusted Extensions require passwords. If the root user does not have a password, then root cannot configure the system.
Use the default crypt_unix password encryption method for the root user. For details, see Managing Password Information in System Administration Guide: Security Services.
Note - Users must not disclose their passwords to another person, as that person might then have access to the data of the user and will not be uniquely identified or accountable. Note that disclosure can be direct, through the user deliberately disclosing her/his password to another person, or indirect, for example, through writing it down, or choosing an insecure password. The Solaris OS provides protection against insecure passwords, but cannot prevent a user from disclosing her or his password, or from writing it down.
Trusted Extensions uses the Solaris Management Console to administer the network. If your system was installed with the End User group or a smaller group, the system does not have the packages for the Solaris Management Console.
Add the following line to the end of the Module section in the /etc/X11/xorg.conf file.
load "xtsol"
Note - By default, the xorg.conf file does not exist. Do nothing if this file does not exist.
Note - Applications must run only in Oracle Solaris Cluster zone clusters.
For more information about Oracle Solaris Cluster support of Trusted Extensions, see "How to Prepare for Trusted Extensions Use With Zone Clusters" in Chapter 7, "Creating Non-Global Zones and Zone Clusters" in the Oracle Solaris Cluster Software Installation Guide.
Chapter 1, What’s New in the Solaris 10 10/08 Release, in Solaris 10 What’s New
Solaris 10 10/08 Release Notes
Tip - To find pertinent information, search for the string Trusted Extensions.
To decide on your zone creation method, see Planning for Zones in Trusted Extensions.
Most systems that are configured with Trusted Extensions install labeled zones. Labeled zones can require more disk space than the installed system has set aside.
However, some Trusted Extensions systems do not require that labeled zones be installed. For example, a multilevel printing server, a multilevel LDAP server, or a multilevel LDAP proxy server do not require labeled zones to be installed. These systems might not need the extra disk space.
Roles administer Trusted Extensions. Consider adding extra swap for role processes.
Trusted Extensions enables auditing by default. For audit files, best practice is to create a dedicated partition.
# netservices limited