Documentation Home
> Trusted Solaris Installation and Configuration
Trusted Solaris Installation and Configuration
Book Information
About This Book
Chapter 1 Overview
The Big Picture
Understand the Trusted Solaris Environment.
Understand Your Site's Security Policy.
Devise an Administration Strategy.
Devise a Label Strategy.
For International Customers
Plan Workstation Hardware and Capacity.
Plan Your Network.
Additional Planning for Open Networks
Plan Auditing.
Devise an Installation and Configuration Strategy.
Collect Information.
Back Up the Workstation.
Install the Trusted Solaris Software.
Configure the Software.
Differences from Solaris 7 Installation and Configuration
Installation Results from an Administrator's Perspective
Chapter 2 Basic Procedures
How to Log In
To Log In as the User Install
To Log In as a Regular User
How to Assume a Role
To Assume a Role
How to Launch a Terminal
To Launch a Terminal
How to Open a Profile Shell
To Open a Profile Shell in an Administrative Role
To Open a Profile Shell as a User or Non-Administrative Role
To List the Commands Available to a Profile Shell
To See Process and Privilege Information in a Profile Shell
How to Create an Admin_High Workspace
How to Protect Machine Hardware
SPARC: To Set the PROM Mode and Password
IA: To Protect the BIOS
How to Limit Contact During Booting
How to Copy Files To and From a Portable Medium
To Copy One or More Files to a Diskette
To Copy One or More Files from a Diskette
How To Install a Site-Specific Label Encodings File
How to Allocate and Deallocate a Device
To Allocate a Device
To Deallocate a Device
How to Open the Application Manager
To Open the Application Manager
How to Use the Solstice_Apps Folder
To Open and Modify a Solstice_Apps Database
To Modify the Password for a Role or User Account
To Customize Idle Time
To Delete a Local User
How to Use the System_Admin Folder
To Run a System_Admin Action
To Create or Open a File from the Trusted Editor
To Open a File that has a Defined Action
To Run a Script from the System_Admin Folder
How to Add Network Interfaces
To Determine the Network Interfaces
To Create the Network Interface Files
How to Share a File System
To Share Home Directories and Other Filesystems
To Check That a Directory Is Shared
To Start the nfs.server Daemon
How to Set the Label on an Unlabeled File System
How to Mount a File System
To Mount a Labeled or Unlabeled File System
How to Update the Commands in a Role's Profile
To Add a Command to a Role's Profile
To Verify That a Command is in a Role's Profile
To Remove a Command from a Role's Profile
How to End a Session
To Lock the Screen
To Log Out
To Reboot the Workstation
Chapter 3 Installing a Workstation
Who Does What
System Installation Step by Step
SPARC: Install from a CDROM
SPARC: Install over the Network
Read Booting Messages
Answer Installation Questions
Installation Program Questions
Disk Partitioning Hints
Read the Log
Enter a root Password
Troubleshooting
Complete OS Server Installation
Complete Network and JumpStart Installations
Chapter 4 Configuring a Workstation without the NIS+ Name Service
Who Does What
Non-Networked Configuration Tasks
Log In and Assume the root Role
Protect the Workstation
Check and Install the label_encodings File
Set Up Network Files
Add Administrative Roles to Three /etc Files
Reboot the Workstation
Update Role Passwords
Add Users to Administer the System
Verify That Users and Administrative Roles Work
Mount Unlabeled File Systems
Share File Systems
Delete the User install
Chapter 5 Configuring the NIS+ Root Master
Who Does What
NIS+ Root Master Configuration Tasks
Log In and Launch a Terminal
Protect the Workstation
Check and Install the label_encodings File
Set Up Routing
To Set Up Simple Static Routing
To Set Up Complex Static Routing
Set Up Additional Network Interfaces
Add the Static Routing Workstations to the Local Hosts Database
Edit the Trusted Network Files
To Edit the Tnrhtp Database (Example)
To Edit the Tnrhdb Database
Summary
Set Up the NIS+ Domain
To Set the Stage
To Set Up NIS+ with Databases from the Staging Area
Set Up DNS
Reboot the Workstation
Update Role Credentials and Passwords
Set Up Home Directories
Install and Configure the Home Directory Server Now
Add Users to be Administrators
Prerequisite
To Create a User
Log Out
Verify that Users and Administrative Roles Work
Set Up Auditing
To Configure Auditing
Set the Label for Unlabeled File Systems (Example)
Share File Systems
Copy Configuration Files for Distribution to Clients
To Transfer Files for NIS+ Clients to Diskette
Delete the User install
Chapter 6 Configuring a NIS+ Client
Who Does What
NIS+ Client Configuration Tasks
Log In and Protect the Workstation
Copy Configuration Files from the NIS+ Master
To Copy Master Files from Diskette
Copy the NIS+ Master label_encodings File
Set Up Static Routing
Set Up Secondary Network Interfaces
Copy the Tnrhtp Database (Example)
Edit the Tnrhdb Database
Verify Communication with the NIS+ Master
Summary
Set Up the NIS+ Name Service
Set Up DNS and the Name Service Switch
Set Up Home Directories
Reboot the Workstation
Add Users
Finish Configuring the Workstation
Secadmin Responsibilities
Admin Responsibilities
Chapter 7 Preparing to Install Trusted Solaris Over a Network
Servers Required for Network Installation
Setting up Network Installation
Commands You Should Know About
Create an Install Server
Prerequisites:
Set the Default Date and Time
Add Client Information for a Network Install
Add Client Information Using the Host Manager
Add Client Information with the add_install_client Command
Remove Client Information with the rm_install_client Command
Check Client Information
Create a Boot Server on a Subnet
Reboot the Install Server
Chapter 8 Preparing Custom JumpStart Installations
Definition: Custom JumpStart Installation
Reasons to Choose a Custom JumpStart Installation
Trusted Solaris Differences in Custom JumpStart
Trusted Solaris Custom JumpStart Additions
Trusted Solaris Custom JumpStart Limitations
Prerequisites for a Custom JumpStart Installation
Tasks to Set up Custom JumpStart Installations
What Happens During a Custom JumpStart Installation
Networked Custom JumpStart Installation
Creating a JumpStart Directory on a Diskette
How to Create a JumpStart Directory on a Diskette
Creating a JumpStart Directory on a Server
How to Create a JumpStart Directory on a Server
Enabling Access to the JumpStart Directory
How to Enable Access to the JumpStart Directory
Method 1: Host Manager
Method 2: add_install_client Command
How to Check Access to the JumpStart Directory
Creating a Profile
Requirements for Profiles
Recommendations for Trusted Solaris Profiles
How to Create a Profile
Profile Examples
Profile Keyword and Profile Value Descriptions
How the Size of Swap Is Determined
Creating the rules File
When Does a System Match a Rule
Recommendations for Trusted Solaris Rules
How to Create the rules File
Rule Examples
Important Information About the rules File
Rule Keyword and Rule Value Descriptions
How the Installation Program Sets the Value of rootdisk
Using check to Validate the rules File
How to Use check to Validate the rules File
Finishing Custom JumpStart
Copy JumpStart Files to jumpstart_dir_path
Check That All Installation Questions Can Be Answered
Chapter 9 Using Optional Custom JumpStart Features
Creating Begin Scripts
Important Information About Begin Scripts
Ideas for Begin Scripts
Creating Derived Profiles With Begin Scripts
Creating Finish Scripts
Important Information About Finish Scripts
Ideas for Finish Scripts
Rebooting the Workstation with a Finish Script
Adding Files With Finish Scripts
Customizing the Root Environment
Setting the System's Root Password With Finish Scripts
Using pfinstall to Test Profiles
Ways to Use pfinstall
How to Use pfinstall to Test a Profile
pfinstall Examples
SPARC: How to Create a Disk Configuration File for a SPARC System
SPARC: How to Create a Multiple Disk Configuration File for a SPARC System
IA: Creating a Disk Configuration File on Intel Architecture
IA: How to Create a Disk Configuration File on Intel Architecture
IA: How to Create a Multiple Disk Configuration File on Intel Architecture
Using a Site-Specific Installation Program
Chapter 10 Configuring Diskless Clients
Prerequisites for Diskless Clients
Install and Configure an OS Server
Path 1 - Create OS Server during Installation
Path 2 - Convert Standalone to OS Server
Access a Trusted Solaris CD Image on a File System
Either:
Or:
Add OS Services
Create a Boot Server
Reboot the OS Server
Configuring Diskless Clients
Add Diskless Clients
Ensure that the Client is Known to the NIS+ Master
Set up Each Client's Mounts
Verify Each Client's tnrhdb Entries
Boot a Diskless Client
Chapter 11 Where to Find...
For Further Configuration
Appendix A Site Security Policy
Site Security Policy and the Distributed System
Computer Security Recommendations
Physical Security Recommendations
Personnel Security Recommendations
Common Security Violations
Additional Security References
U.S. Government Publications
UNIX Security Publications
General Computer Security Publications
General UNIX Publications
Appendix B Checklists for Configuring and Installing Trusted Solaris
Site Summary Checklist
Background Checklist
Checklist Summaries
Planning Labels
Label Decisions
Planning the Network
Open Network Security Information
NIS+ Domain Information
Labels of Communicating Machines
Planning Auditing
Auditing Security Information
Auditing System Information
Planning Workstations
System Information for Each Machine
Security Information for Each Machine
Appendix C Sample Custom JumpStart Installation
Sample Site Setup
Create a JumpStart directory.
Share the JumpStart directory.
Create the eng_profile profile.
Create the marketing_profile profile.
Edit the rules file.
Execute the check script.
Set up the engineering systems for installation.
Set up the marketing systems for installation.
Boot the systems and install Trusted Solaris software.
Appendix D Example Worksheets
How to Use the Examples
Root NIS+ Master Installation Program Example
Root NIS+ Master Disk Partitioning Example
Services Provided by Each Workstation Example
Standalone Workstation Installation Program Example - Audit Server
Standalone Disk Partitioning Example - Audit Server
Standalone Workstation Configuration Worksheet - Audit Server
OS Server Installation Program Example
OS Server Disk Partitioning Example
OS Server Configuration Worksheet
Remote Hosts Worksheet - Example
Remote Hosts (tnrhdb) Worksheet for NIS+ Root Master - Example
Remote Hosts (tnrhdb) Worksheet for Individual Workstations - Example
User Worksheet Example
Glossary
Index
Numbers and Symbols
A
B
C
D
E
F
H
I
J
K
L
M
N
O
P
R
S
T
U
V
W
© 2010, Oracle Corporation and/or its affiliates