Solaris Security Toolkit 4.1.1 Release Notes

These release notes for the Solaris Security Toolkit 4.1.1 software contain the following topics:

Changes in Solaris Security Toolkit 4.1.1 Software

Support for SMS 1.5 Software

Required Operating Systems

Solaris Security Toolkit Documentation

Solaris Security Toolkit Known Limitations

General Notes and Issues

Bugs in Solaris Security Toolkit Software

Errata in Solaris Security Toolkit Documentation

Changes in Solaris Security Toolkit 4.1.1 Software

This section summarizes the pertinent changes made to the Solaris Security Toolkit 4.1 software for the Solaris Security Toolkit 4.1.1 software release.

Note - The Solaris Security Toolkit 4.1.1 software release is not a bug fix release from the Solaris Security Toolkit 4.1 software release.

SMS 1.5 support is added.

SMS 1.5 users are required to execute undo and rehardening in a specific order to make sure failover works for SMS versions less than 1.5. To function, SMS versions less than 1.5 require certain services to be enabled: login, shell, and exec. Refer to Chapter 2 of the System Management Services (SMS) 1.5 Administrator Guide or the System Management Services (SMS) 1.5 Release Notes for more detail.

Secure Shell (ssh) and insecure services do not need to be configured for failover to work.

Setting the static Address Resolution Protocol (ARP) on the SC is no longer required.

Domain exclusion must be done manually. Refer to the System Management Services (SMS) 1.5 Administrator Guide for instructions.

Required Operating Systems

Solaris Security Toolkit 4.1.1 software works only with Solaris 8 or 9 Operating Systems. This Solaris Security Toolkit 4.1.1 release does not support nor does it work with the Solaris 10 Operating System.

Support for SMS 1.5 Software

The Solaris Security Toolkit 4.1.1 software supports the System Management Services (SMS) 1.5 software, including the secure by default feature. To use these features, you need to use Solaris Security Toolkit 4.1.1 software on the system controller (SC). You can find detailed information about securing Sun Fire high-end systems in the System Management Services (SMS) 1.5 Administrator Guide, Chapter 2.

Solaris Security Toolkit Documentation

For generic information that applies to all Solaris Security Toolkit software, refer to the Solaris Security Toolkit 4.1 documentation at:

http://www.sun.com/products-n-solutions/hardware/docs/ Software/enterprise_computing/systems_management/sst/index.html

Solaris Security Toolkit Known Limitations

This section contains known limitations for the Solaris Security Toolkit 4.1 and 4.1.1 software:

While the Solaris Security Toolkit 4.1.1 software maintains its functionality for disabling system accounts (see the finish script disable-system-accounts.fin), it no longer modifies the system to record login attempts to those disabled accounts.

General Notes and Issues

This section contains general notes and issues that involve the Solaris Security Toolkit 4.1 and 4.1.1 software.

SMS Software and the Solaris Security Toolkit

Supported SMS upgrade and downgrade are referenced in the SMS high-end system product documentation. When performing SMS upgrade/downgrade operations on System Controllers hardened by the Solaris Security Toolkit, run in audit mode after the upgrade/downgrade is complete. Running in audit mode verifies that the System Controller is in the proper configuration. If any vulnerabilities are identified, rerun hardening.

Solaris Security Toolkit and `CTRL-C`

Performing a CTRL-C during Solaris Security Toolkit hardening and undo operations could result in an inconsistent system state. Hardening operations should be allowed to complete and then a subsequent undo operation performed instead of interrupting the hardening operation. Do not use CTRL-C for error handling or to interrupt a Toolkit run. Wait until the operation has finished and then re-perform hardening or undo operations.

`fix-modes` Display Warnings

When executing fix-modes during package installation, secure-modes warnings are displayed. These warnings are the result of a file formatting problem in Solaris software and can be ignored safely.

Solaris Security Toolkit Questionnaire

To better understand the needs and requirements of the Solaris Security Toolkit users, a questionnaire has been placed in the Documentation directory (<JASS_HOME directory>/Documentation/QUESTIONNAIRE). The purpose of this survey is to better focus on customer needs in future development efforts. Your participation would be greatly appreciated.

Submit completed surveys to: sst-questionnaire@sun.com

Bugs in Solaris Security Toolkit Software

This section summarizes the most important bugs and RFEs in the Solaris Security Toolkit 4.1 and 4.1.1 software.

`undo` Reports `logadm.conf` Changed (Bug ID 5067303)

If, after hardening the system with the update-cron-log-size.fin and enable-process-accounting.fin scripts, the system is rebooted and an undo of the hardening run performed, the undo reports that /etc/logadm.conf has changed and prompts with the usual Backup, Force, or Keep options.

Since the user has not performed any manual editing of /etc/logadm.conf the undo should apply cleanly and not require user action.

Workaround: In this instance, choose the Force option.

If the /etc/logadm.conf has been edited, use the Backup or Keep options.

Errata in Solaris Security Toolkit Documentation

This section contains descriptions of errata in the Solaris Security Toolkit 4.1 documentation.

`banner.msg` Mention Missing from Reference Manual (Bug ID 6177578)

The/etc/ftpd/banner.msg file is missing from the file list of the set-banner-ftpd.fin section in Chapter 4 of the Solaris Security Toolkit 4.1 Reference Manual.

Workaround: None. This is a documentation bug only. This file is present in the software.

Deprecated `env` `var` (Bug ID 6177598)

The environment variable JASS_SHELL_DISABLE is no longer used and has been removed from the Solaris Security Toolkit 4.1.1 software. The environment variable JASS_SHELL_DISABLE is mentioned in the Solaris Security Toolkit 4.1 Reference Manual and should be ignored.

Workaround: Do not attempt to use this variable. It no longer works.