man pages section 4: File Formats

tnrhdb(4)

NAME

tnrhdb- Trusted network remote-host database

SYNOPSIS

/etc/security/tsol/tnrhdb

DESCRIPTION

The tnrhdb database specifies which remote-host template to use for each host, including the local host, in the distributed system. tnrhdb works together with the tnrhtp(4) database in allowing the administrator to establish the security and network accreditation attributes for each host. The trusted-network software uses a network "longest prefix of matching bits" mechanism in looking for a tnrhdb entry for a host. The software looks first for an entry specific to the host; if it does not find one, the software falls back to searching for an entry with the longest prefix of a matching bit pattern, and so on.

Using this mechanism, an IPv4 wildcard entry (IPv4 address 0.0.0.0) has a prefix length of 0 and hence can match any IPv4 address. If a host's IP address cannot be matched to some entry in the tnrhdb database, communication with the host is not permitted.

Each entry consists of a line of this form:

IP_address:template_name

IP_address

This field is the IP address of the host or network that has the security properties specified by the template_name defined in the tnrhtp database.

An entry can either be an IPv4 or IPv6 address of a host (for example, 10.100.100.201 or fe80\:\:a00\:20ff\:fea0\:21f7), or a wildcard IPv4 or IPv6 address of a subnet. An IPv4 wildcard address can be either in the form of a class A, B, or C address (10.100.0.0) or a subnet_address with a prefix length (10.100.128.0/17). An IPv6 wildcard entry is a subnet address with a prefix length (fe80\:\:/10).

Any colon (:) character in an IPv6 address must be escaped with a backslash (\), as in fe80\:\:a00\:20ff\:fea0\:21f7.

template_name

This value must be a valid template name in the tnrhtp database. See man pages for tnrhtp(4) for information on the security attributes. More than one IP address can use the same template. If this database is modified while the network is up, the changes do not take effect until after tnctl(1M) is used to update the remote-host entries. Administrators are allowed to add new entries and modify existing entries while network is up.

Errors in the format of this file can be detected by running tnchkdb, which should be run every time the database is modified or created. Refer to the tnchkdb(1M) man page for more information.

/etc/security/tsol/tnrhdb should have a sensitivity label of ADMIN_LOW with permission bits 444, owner sys, and group sys.

ATTRIBUTES

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWtsr

EXAMPLES

Example 1 A Sample tnrhdb

The templates in the following example are first defined in the tnrhtp, then used in the tnrhdb file. The example shows a host that uses template ripso_secure_route, a host that uses template tsol, a subnet that uses template tsol, a subnet that uses template secret; and every other host uses the default_template template specified in the wildcard entry. .

 #
 # Assume that templates default_template, tsol, secret, and 
 # ripso_secure_route are defined in the tnrhtp database.
 #
 # the first entry is the localhost
   127.0.0.1
   192.110.120.6:tsol
   192.110.120.0:tsol
   192.110.120.7:ripso_secure_route
   192.110.121.0:secret
   0.0.0.0:default
   \:\:1:tsol
   fe80\:\:a00\:20ff\:fea0\:21f7:tsol

FILES

/etc/security/tsol/tnrhdb: Trusted network remote-host database

Trusted Solaris 8 Reference Manual

tnd(1M), tnchkdb(1M), tnctl(1M), tnidb(4), tnrhtp(4)

SunOS 5.8 Reference Manual

hosts(4), ipnodes(4), attributes(5)

WARNINGS

For proper functioning, the primary host name must point to a template that has min_sl=ADMIN_LOW (in hex) and max_sl=ADMIN_HIGH (in hex).

Changing a template while the network is up can change the security view of an undetermined number of hosts.

NOTES

The colon (:) character is a database separation character, so it must be escaped with a backslash (\) if used as part of a data field, as in fe80\:\:a00\:20ff\:fea0\:21f7.

The administrator may wish to make one tnrhdb entry for each host running the Trusted Solaris release, and make one subnet entry that applies to all unlabeled hosts that have the same security attributes. Then, the administrator may make a separate entry for each host that must be assigned a different set of security attributes.

Trusted Solaris 8 Last Revised 6 Oct 2000