C H A P T E R  5

SMS 1.4.1 Security Options

This chapter contains information on securing the System Management Services (SMS) 1.4.1 software under the Solaris operating environment. These instructions apply to the Sun Fire high-end server systems.

The following security options are available in SMS 1.4.1:

Strongly Recommended

• Use Secure Shell (ssh) as an alternative transport for fomd (failover management daemon).

• Disable ARP (Address Resolution Protocol) on the I1 MAN network between the SCs and domains.

Optional

• Disable all IP traffic between the SC and a domain by excluding that domain from the SC's MAN driver.

By using ssh as an alternative transport for fomd, the SCs no longer require a /.rhosts file. Secure Shell provides user authentication and encrypts all network traffic; it prevents an intruder from being able to read an intercepted communication or from spoofing the system.

To protect against ARP spoofing and IP-based attacks, We strongly recommend that you disable ARP on the MAN network in all multi-domain configurations. For systems where domain separation is critical, we also recommend disabling IP connectivity between the SC and specific domains that require separation.

Before you implement the above security options, we strongly recommend that you you modify (harden) your Solaris Operating Environment configurations on the SCs and domains to improve overall system security. For details, refer to following Sun BluePrints Online articles available at:

http://www.sun.com/security/blueprints

• Solaris Operating Environment Security - Updated for Solaris 8 Operating Environment

• Solaris Operating Environment Security - Updated for Solaris 9 Operating Environment

For step-by-step instructions on implementing the three options, which involve the use of the Solaris Security Toolkit (SST, a/k/a JASS), and detailed description of all security recommendations for Sun Fire high end systems, refer to the following Sun BluePrints Online articles available at:

http://www.sun.com/security/blueprints

• Securing the Sun Fire 12K and 15K (or High-End) System Controllers: Updated for SMS 1.4 or later.

• Securing the Sun Fire 12K and 15K (or High-End) Domains: Updated for SMS 1.4 or later.