test

Trusted Solaris User's Guide

Chapter 2 Entering and Leaving the Trusted Solaris Environment

This chapter describes how to enter and leave the Trusted Solaris environment.

The Login Process

Before you can log in to the Trusted Solaris environment, your system administrator and security administrator must set up a user account for you. The account gives you permission to use some of the computer facilities and contains identifying information, such as the username assigned to you and your user ID (UID). The username in conjunction with your password lets you log into the system. The user ID identifies all of your transactions as well as the files and directories that you own.

An overview of the login process is shown in Figure 2-1. The process is described in more detail in the material following the overview figure. The steps in the process include:

Figure 2-1 Trusted Solaris Environment Login Process

Graphic

Identifying Yourself

When a Trusted Solaris workstation is not in a work session, it displays the login screen. The login screen initially contains the username dialog box, which enables the next user to provide a username (see Figure 2-2). This is the identification part of the login process.

Figure 2-2 Username Dialog Box

Graphic

If you are logging in remotely, see "To Log In Remotely"; if you are logging in locally, see "To Identify Yourself to the System".

To Log In Remotely

  1. Choose Remote Login from the Options menu in the Username dialog box (see Figure 2-2).

  2. Select Enter Host name or Chose Host from List, and provide the host name.

    • If you selected Enter Host Name, type the host name.

    • If you selected Choose Host from List, select the host name from the list.

    The host you specify must be running a compatible version of the Trusted Solaris environment.

    The Username dialog box reappears with the remote host name displayed. You can now go on to the next procedure, identifying yourself to the sytem.

To Identify Yourself to the System

  1. Type your username in the text field in the username dialog box (see Figure 2-2).

    Be sure to type it exactly as your administrator assigned it to you with regard to spelling and capitalization.

  2. Click the OK button (or press Return) to confirm your entry of the username; to re-enter your username, click Start Over.

    To restart the windowing system completely, you can click Reset Login.

    Caution - Caution -

    You should never see the Trusted Stripe when the login screen appears. If you ever see the screen stripe while attempting to log in or unlock the screen, do not type your password. There is a chance you are being spoofed. A spoof is when an intruder's program is masquerading as a login program to capture passwords.

Authenticating Yourself

After you have entered the username, the username dialog box is replaced in the login screen by the password dialog box (see Figure 2-3). This part of the process is referred to as authentication, that is, authenticating that you are indeed the user authorized to use that username.

A password is a private combination of keystrokes that validates your identity to the system. Since it is stored in an encrypted form, your password is not accessible by other users on the system. It is your responsibility to protect your password so that other users cannot use it to gain unauthorized access. Never write your password down or disclose it to anyone else, because a person with your password has access to all your data without being identifiable or accountable. Your initial password is supplied by your Trusted Solaris administrator.

To Authenticate Yourself

  1. Type your password in the password entry field.

    For security purposes, the characters do not actually display in the field.

    Figure 2-3 Password Dialog Box

    Graphic

  2. Click the OK button, or press Return, to confirm your entry of the password or select one of the other options if you are not ready to log in.

    If you are ready to log in, click OK or press Return. Otherwise, you have these options:

    • Click the Start Over button to re-enter your username.

    • Click Reset Login in the Options menu to restart the windowing system.

    The system compares the entered login name and password against a list of authorized users. If the password you provided is incorrect, a message dialog box appears displaying the message:


    Login incorrect; please try again.

    Click OK to dismiss the error dialog box and type the password again.

Message Checking and Selecting Session Type

After you successfully enter your username and password, the Workstation Information dialog box is displayed (see Figure 2-4). It provides status information and, if your account is configured for user-specified sessions, lets you a select a single- or multi-level session. Note that because this account is configured for multi-level operation, there is an option for restricting the session to a single level; this option is not available for single-level accounts.

Figure 2-4 Workstation Information Dialog Box

Graphic

To Check Messages and Select Session Type

  1. Check the date and time of the last login.

    This field indicates when your system was last used. You should always check that there is nothing suspicious about the last login, such as an unusual time of day, and report such occurrences to your security administrator.

  2. Read any messages in the Message of the Day field.

    This field contains messages from your administrator. Since this message may contain warnings about scheduled maintenance or security problems, you should always read it.

  3. Read any console messages since last logout.

    Typically, these system messages contain messages concerning cron (batch) jobs, but you should check that there are no messages indicating suspicious activity or other problems.

  4. Select Restrict Session To A Single Label if you intend to work at only one label in your session (not available in single-label configurations).

    If you do not select this option, you are implicitly selecting a multi-level session and can view data at different labels. The range in which you can operate is bounded at the upper end by the session clearance that you select in the session clearance dialog box and at the lower end by the minimum label assigned to you by your administrator.

  5. Click OK (or press Return).

    • If your account is configured for a single-level operation, the Trusted Solaris environment is displayed. You can proceed to "Leaving the Trusted Solaris Environment ".

    • If your account is a multi-level configuration, a version of the Label Builder dialog box appears.

  6. Set the session level.

    Note -

    Workstations can be restricted to a limited range of session clearances and labels. For example, a workstation in a lobby might be limited to UNCLASSIFIED labels only. If the session clearance or label you enter is not accepted, check with an administrator to see if the workstation is restricted.

    • To accept the default value in the Clearance field (for multi-level configurations) or Label field (for a single-level session), click OK or press Return. The Trusted Solaris environment will be displayed.

    • To create a different label or clearance, continue with this procedure.

  7. Select the desired classification in the Class list.

  8. (Optional) Select the desired compartments in the Comps list.

  9. Verify the clearance or label you have built.

    • If it is correct, click OK or press Return.

    • If you want to make changes, adjust the values you selected in the Class or Comps list.

Figure 2-5 Session Clearance Builder Dialog Box

Graphic

Leaving the Trusted Solaris Environment

If you leave your logged-on terminal unattended, you create a security risk. Make a habit of securing your terminal before leaving it. If you plan to return shortly, lock your screen. (In most facilities, the screen times out after a specified period of idleness and automatically locks.) If you expect to be gone for a while or you expect someone else to use your terminal, log out.

To Lock and Unlock Your Screen

  1. To lock your screen, click the screen lock icon in the switch area of the Front Panel (see Figure 2-6).

    Figure 2-6 Front Panel Switch Area

    Graphic

    The screen turns black and the dialog box shown in Figure 2-7 is displayed.

    Figure 2-7 Lock Screen Dialog Box

    Graphic

    Note -

    The Trusted Stripe should not be displayed when the screen is locked. If it does appear, notify your security administrator immediately.

  2. To unlock your screen, type your password in the password entry field and press Return.

    This returns you to your session in its previous state.

To Log Out of the Trusted Solaris Environment

  1. Click the EXIT icon in the switch area of the front panel (see Figure 2-6).

    The confirmation dialog box shown in Figure 2-8 is displayed.

    Figure 2-8 Logout Confirmation Dialog Box

    Graphic

  2. Click OK to continue the logout process.

To Shut Down Your System

Logging out is the normal way to end a Trusted Solaris session. If you need to turn off your machine (and you are authorized to shut down your system), you should use the Shut Down menu option and then turn off your power. If you do shut down your machine, it may require rebooting by a user with additional authorization depending on your security policy.

  1. Choose Shut Down from the Trusted Path menu (see Tour: Exploring the Basic Trusted Solaris Environment).

    A confirmation dialog box is displayed.

  2. Click OK if you definitely want to shut down your system or Cancel if you want to reconsider.

    Note -

    The keyboard combination Stop-A (L1-A) is not available in the Trusted Solaris environment unless specially configured by your security administrator.

Enabling Logins When Logins Are Disabled

As a security measure, your administrator can configure your site so that all logins are disabled after a reboot. If a reboot has occurred and you are not authorized to enable logins, the dialog box shown in Figure 2-9 appears; you must notify your Trusted Solaris administrator to help you log in. If you are authorized to enable logins, the dialog box shown in Figure 2-10 appears.

Figure 2-9 Logins Disabled Dialog Box for Users Unauthorized to Enable Logins

Graphic

Figure 2-10 Logins Disabled Dialog Box for Users Authorized to Enable Logins

Graphic

To Enable Logins After a Reboot

  1. Enter the appropriate Enable logins option (see Figure 2-10)

    • Enter 1 to enable logins for all users and then log in, or 3 to enable logins for all users without logging in.

    • Enter 2 to leave other logins disabled and then log in, or 4 to leave other logins disabled and not log in.

      Do this if you are not ready to enable logins.

  2. Click OK to enable or leave disabled the logins as specified or click Cancel to leave logins in their current state.

    Both options dismiss the dialog box and reset logins as specified.

Fixing a Bad Desktop Profile

If you have customized your shell initialization files (.cshrc, .login, and the like) and cannot log in, you can use the failsafe login feature to log in and correct the situation. In a standard login, the shell initialization files are sourced at startup to provide features customized for your environment. In a failsafe login, the default values are applied to your environment and no shell initialization files are sourced. This guarantees your ability to log in and permits you to fix any problems in shell initialization files.

To Perform a Failsafe Login

  1. Type your username in the text field in the username dialog box (see Figure 2-2).

  2. Click the Options button and choose Failsafe Session from the Session submenu.

  3. Click the OK button (or press Return) and perform the rest of the steps in a standard login.

  4. Edit the shell initialization file where you think the problem may be occurring.