Chapter 5 Configuring LDAP for Trusted Extensions (Tasks)

This chapter covers how to configure the Sun Java^TM System Directory Server and the Solaris Management Console for use with Trusted Extensions. The Directory Server provides LDAP services. LDAP is the supported naming service for Trusted Extensions. The Solaris Management Console is the administrative GUI for local and LDAP databases.

You have two options when configuring the Directory Server. You can configure an LDAP server on a Trusted Extensions system, or you can use an existing server and connect to it by using a Trusted Extensions proxy server. Follow the instructions in one of the following task maps:

• Configuring an LDAP Server on a Trusted Extensions Host (Task Map)

• Configuring an LDAP Proxy Server on a Trusted Extensions Host (Task Map)

Configuring an LDAP Server on a Trusted Extensions Host (Task Map)

Configuring an LDAP Proxy Server on a Trusted Extensions Host (Task Map)

Use this task map if you have an existing Sun Java System Directory Server that is running on a Solaris system.

Configuring the Sun Java System Directory Server on a Trusted Extensions System

The LDAP naming service is the supported naming service for Trusted Extensions. If your site is not yet running the LDAP naming service, configure a Sun Java System Directory Server (Directory Server) on a system that is configured with Trusted Extensions.

If your site is already running a Directory Server, then you need to add the Trusted Extensions databases to the server. To access the Directory Server, you then set up an LDAP proxy on a Trusted Extensions system.

If you do not use this LDAP server as an NFS server or as a server for Sun Ray^TM clients, then you do not need to install any labeled zones on this server.

Collect Information for the Directory Server for LDAP

1. Determine the values for the following items.

   The items are listed in the order of their appearance in the Sun Java Enterprise System Install Wizard.

   Install Wizard Prompt	Action or Information
   Sun Java System Directory Server version
   Administrator User ID	The default value is admin.
   Administrator Password	Create a password, such as admin123.
   Directory Manager DN	The default value is cn=Directory Manager.
   Directory Manager Password	Create a password, such as dirmgr89.
   Directory Server Root	The default value is /var/Sun/mps. This path is also used later if the proxy software is installed.
   Server Identifier	The default value is the local system.
   Server Port	If you plan to use the Directory Server to provide standard LDAP naming services to client systems, use the default value, 389. If you plan to use the Directory Server to support a subsequent installation of a proxy server, enter a nonstandard port, such as 10389.
   Suffix	Include your domain component, as in dc=example-domain,dc=com.
   Administration Domain	Construct to correspond to the Suffix, as in, example-domain.com.
   System User	The default value is root.
   System Group	The default value is root.
   Data Storage Location	The default value is Store configuration data on this server.
   Data Storage Location	The default value is Store user data and group data on this server.
   Administration Port	The default value is the Server Port. A suggested convention for changing the default is software-version TIMES 1000. For software version 5.2, this convention would result in port 5200.

Install the Sun Java System Directory Server

The Directory Server packages are available from the Sun Software Gateway web site.

Before You Begin

You are on a Trusted Extensions system with only a global zone installed. The system has no labeled zones.

Trusted Extensions LDAP servers are configured for clients that use pam_unix to authenticate to the LDAP repository. With pam_unix, the password operations, and therefore the password policy, are determined by the client. Specifically, the policy set by the LDAP server is not used. For the password parameters that you can set on the client, see Managing Password Information in System Administration Guide: Security Services. For information about pam_unix, see the pam.conf(4) man page.

The use of pam_ldap on an LDAP client is not an evaluated configuration for Trusted Extensions.

1. Before you install the Directory Server packages, add the FQDN to your system's hostname entry.

   The FQDN is the Fully Qualified Domain Name. This name is a combination of the host name and the administration domain, as in:

   ## /etc/hosts ... 192.168.5.5 myhost myhost.example-domain.com

   On a system that is running a release prior to the Solaris 10 8/07 release, add IPv4 and IPv6 entries to the /etc/inet/ipnodes file. The entries for one system must be contiguous in the file.

   If you are not running the latest release of the Solaris OS, you must have the following patches installed. The first number is a SPARC patch. The second number is an X86 patch.

   • 138874–05, 138875–05: Native LDAP, PAM, name-service-switch patch

   • 119313-35, 119314-36: WBEM patch

   • 121308-21, 121308-21: Solaris Management Console patch

   • 119315-20, 119316-20: Solaris Management Applications patch

2. Find the Sun Java System Directory Server packages on the Oracle Sun web site.

   1. On the Sun Software Gateway page, click the Get It tab.

   2. Click the checkbox for the Sun Java Identity Management Suite.

   3. Click the Submit button.

   4. If you are not registered, register.

   5. Log in to download the software.

   6. Click the Download Center at the upper left of the screen.

   7. Under Identity Management, download the most recent software that is appropriate for your platform.

3. Install the Directory Server packages.

   Answer the questions by using the information from Collect Information for the Directory Server for LDAP. For a full list of questions, defaults, and suggested answers, see Chapter 11, Setting Up Sun Java System Directory Server With LDAP Clients (Tasks), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) and Chapter 12, Setting Up LDAP Clients (Tasks), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).

4. (Optional) Add the environment variables for the Directory Server to your path.

   # $PATH /usr/sbin:.../opt/SUNWdsee/dsee6/bin:/opt/SUNWdsee/dscc6/bin:/opt/SUNWdsee/ds6/bin: /opt/SUNWdsee/dps6/bin

5. (Optional) Add the Directory Server man pages to your MANPATH.

   /opt/SUNWdsee/dsee6/man

6. Enable the cacaoadm program and verify that the program is enabled.

   # /usr/sbin/cacaoadm enable # /usr/sbin/cacaoadm start start: server (pid n) already running

7. Ensure that the Directory Server starts at every boot.

   Templates for the SMF services for the Directory Server are in the Sun Java System Directory Server packages.

   • For a Trusted Extensions Directory Server, enable the service.

     # dsadm stop /export/home/ds/instances/your-instance # dsadm enable-service -T SMF /export/home/ds/instances/your-instance # dsadm start /export/home/ds/instances/your-instance

     For information about the dsadm command, see the dsadm(1M) man page.

   • For a proxy Directory Server, enable the service.

     # dpadm stop /export/home/ds/instances/your-instance # dpadm enable-service -T SMF /export/home/ds/instances/your-instance # dpadm start /export/home/ds/instances/your-instance

     For information about the dpadm command, see the dpadm(1M) man page.

8. Verify your installation.

   # dsadm info /export/home/ds/instances/your-instance Instance Path: /export/home/ds/instances/your-instance Owner: root(root) Non-secure port: 389 Secure port: 636 Bit format: 32-bit State: Running Server PID: 298 DSCC url: - SMF application name: ds--export-home-ds-instances-your-instance Instance version: D-A00

Troubleshooting

For strategies to solve LDAP configuration problems, see Chapter 13, LDAP Troubleshooting (Reference), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).

Create an LDAP Client for the Directory Server

You use this client to populate your Directory Server for LDAP. You must perform this task before you populate the Directory Server.

You can create the client temporarily on the Trusted Extensions Directory Server, then remove the client on the server, or you can create an independent client.

1. Install Trusted Extensions on a system.

   You can use the Trusted Extensions Directory Server, or install Trusted Extensions on a separate system.

   ---

   Note –

   If you are not running the latest release of the Solaris OS, you must have the following patches installed. The first number is a SPARC patch. The second number is an X86 patch.

   • 138874–05, 138875–05: Native LDAP, PAM, name-service-switch patch

   • 119313-35, 119314-36: WBEM patch

   • 121308-21, 121308-21: Solaris Management Console patch

   • 119315-20, 119316-20: Solaris Management Applications patch

   ---

2. On the client, modify the default /etc/nsswitch.ldap file.

   The entries in bold indicate the modifications. The file appears similar to the following:

   # /etc/nsswitch.ldap # # An example file that could be copied over to /etc/nsswitch.conf; it # uses LDAP in conjunction with files. # # "hosts:" and "services:" in this file are used only if the # /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports. # LDAP service requires that svc:/network/ldap/client:default be enabled # and online. # the following two lines obviate the "+" entry in /etc/passwd and /etc/group. passwd: files ldap group: files ldap # consult /etc "files" only if ldap is down. hosts: files ldap dns [NOTFOUND=return] files # Note that IPv4 addresses are searched for in all of the ipnodes databases # before searching the hosts databases. ipnodes: files ldap [NOTFOUND=return] files networks: files ldap [NOTFOUND=return] files protocols: files ldap [NOTFOUND=return] files rpc: files ldap [NOTFOUND=return] files ethers: files ldap [NOTFOUND=return] files netmasks: files ldap [NOTFOUND=return] files bootparams: files ldap [NOTFOUND=return] files publickey: files ldap [NOTFOUND=return] files netgroup: ldap automount: files ldap aliases: files ldap # for efficient getservbyname() avoid ldap services: files ldap printers: user files ldap auth_attr: files ldap prof_attr: files ldap project: files ldap tnrhtp: files ldap tnrhdb: files ldap

3. In the global zone, run the ldapclient init command.

   This command copies the nsswitch.ldap file to the nsswitch.conf file.

   In this example, the LDAP client is in the example-domain.com domain. The server's IP address is 192.168.5.5.

   # ldapclient init -a domainName=example-domain.com -a profileNmae=default \ > -a proxyDN=cn=proxyagent,ou=profile,dc=example-domain,dc=com \ > -a proxyDN=cn=proxyPassword={NS1}ecc423aad0 192.168.5.5 System successfully configured

4. Set the server's enableShadowUpdate parameter to TRUE.

   # ldapclient -v mod -a enableShadowUpdate=TRUE \ > -a adminDN=cn=admin,ou=profile,dc=example-domain,dc=com System successfully configured

   For information about the enableShadowUpdate parameter, see enableShadowUpdate Switch in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) and the ldapclient(1M) man page.

Configure the Logs for the Sun Java System Directory Server

This procedure configures three types of logs: access logs, audit logs, and error logs. The following default settings are not changed:

• All logs are enabled and buffered.

• Logs are placed in the appropriate /export/home/ds/instances/your-instance/logs/LOG_TYPE directory.

• Events are logged at log level 256.

• Logs are protected with 600 file permissions.

• Access logs are rotated daily.

• Error logs are rotated weekly.

The settings in this procedure meet the following requirements:

• Audit logs are rotated daily.

• Log files that are older than 3 months expire.

• All log files use a maximum of 20,000 MBytes of disk space.

• A maximum of 100 log files is kept, and each file is at most 500 MBytes.

• The oldest logs are deleted if less than 500 MBytes free disk space is available.

• Additional information is collected in the error logs.

1. Configure the access logs.

   The LOG_TYPE for access is ACCESS. The syntax for configuring logs is the following:

   dsconf set-log-prop LOG_TYPE property:value

   # dsconf set-log-prop ACCESS max-age:3M # dsconf set-log-prop ACCESS max-disk-space-size:20000M # dsconf set-log-prop ACCESS max-file-count:100 # dsconf set-log-prop ACCESS max-size:500M # dsconf set-log-prop ACCESS min-free-disk-space:500M

2. Configure the audit logs.

   # dsconf set-log-prop AUDIT max-age:3M # dsconf set-log-prop AUDIT max-disk-space-size:20000M # dsconf set-log-prop AUDIT max-file-count:100 # dsconf set-log-prop AUDIT max-size:500M # dsconf set-log-prop AUDIT min-free-disk-space:500M # dsconf set-log-prop AUDIT rotation-interval:1d

   By default, the rotation interval for audit logs is one week.

3. Configure the error logs.

   In this configuration, you specify additional data to be collected in the error log.

   # dsconf set-log-prop ERROR max-age:3M # dsconf set-log-prop ERROR max-disk-space-size:20000M # dsconf set-log-prop ERROR max-file-count:30 # dsconf set-log-prop ERROR max-size:500M # dsconf set-log-prop ERROR min-free-disk-space:500M # dsconf set-log-prop ERROR verbose-enabled:on

4. (Optional) Further configure the logs.

   You can also configure the following settings for each log:

   # dsconf set-log-prop LOG_TYPE rotation-min-file-size:undefined # dsconf set-log-prop LOG_TYPE rotation-time:undefined

   For information about the dsconf command, see the dsconf(1M) man page.

Configure a Multilevel Port for the Sun Java System Directory Server

To work in Trusted Extensions, the server port of the Directory Server must be configured as a multilevel port (MLP) in the global zone.

1. Start the Solaris Management Console.

   # /usr/sbin/smc &

2. Select the This Computer (this-host: Scope=Files, Policy=TSOL) toolbox.

3. Click System Configuration, then click Computers and Networks.

   You are prompted for your password.

4. Type the appropriate password.

5. Double-click Trusted Network Zones.

6. Double-click the global zone.

7. Add a multilevel port for the TCP protocol:

   1. Click Add for the Multilevel Ports for Zone's IP Addresses.

   2. Type 389 for the port number, and click OK.

8. Add a multilevel port for the UDP protocol:

   1. Click Add for the Multilevel Ports for Zone's IP Addresses.

   2. Type 389 for the port number.

   3. Choose the udp protocol, and click OK.

9. Click OK to save the settings.

10. Update the kernel.

    # tnctl -fz /etc/security/tsol/tnzonecfg

Populate the Sun Java System Directory Server

Several LDAP databases have been created or modified to hold Trusted Extensions data about label configuration, users, and remote systems. In this procedure, you populate the Directory Server databases with Trusted Extensions information.

Before You Begin

You must populate the database from an LDAP client where shadow updating is enabled. For the prerequisites, see Create an LDAP Client for the Directory Server.

If site security requires separation of duty, complete the following before populating the Directory server:

• Create Rights Profiles That Enforce Separation of Duty

• Create the Security Administrator Role in Trusted Extensions

• Create a Restricted System Administrator Role

1. Create a staging area for files that you plan to use to populate the naming service databases.

   # mkdir -p /setup/files

2. Copy the sample /etc files into the staging area.

   # cd /etc # cp aliases group networks netmasks protocols /setup/files # cp rpc services auto_master /setup/files # cd /etc/security # cp auth_attr prof_attr exec_attr /setup/files/ # # cd /etc/security/tsol # cp tnrhdb tnrhtp /setup/files

   If you are running the Solaris 10 11/06 release without patches, copy the ipnodes file.

   # cd /etc/inet # cp ipnodes /setup/files

3. Remove the +auto_master entry from the /setup/files/auto_master file.

4. Remove the ?:::::? entry from the /setup/files/auth_attr file.

5. Remove the :::: entry from the /setup/files/prof_attr file.

6. Create the zone automaps in the staging area.

   In the following list of automaps, the first of each pair of lines shows the name of the file. The second line of each pair shows the file contents. The zone names identify labels from the default label_encodings file that is included with the Trusted Extensions software.

   • Substitute your zone names for the zone names in these lines.

   • myNFSserver identifies the NFS server for the home directories.

   /setup/files/auto_home_public * myNFSserver_FQDN:/zone/public/root/export/home/& /setup/files/auto_home_internal * myNFSserver_FQDN:/zone/internal/root/export/home/& /setup/files/auto_home_needtoknow * myNFSserver_FQDN:/zone/needtoknow/root/export/home/& /setup/files/auto_home_restricted * myNFSserver_FQDN:/zone/restricted/root/export/home/&

7. Add every system on the network to the /setup/files/tnrhdb file.

   No wildcard mechanism can be used here. The IP address of every system to be contacted, including the IP addresses of labeled zones, must be in this file.

   1. Open the trusted editor and edit /setup/files/tnrhdb.

   2. Add every IP address on a labeled system in the Trusted Extensions domain.

      Labeled systems are of type cipso. Also, the name of the security template for labeled systems is cipso. Therefore, in the default configuration, a cipso entry is similar to the following:

      192.168.25.2:cipso

      ---

      Note –

      This list includes the IP addresses of global zones and labeled zones.

      ---

   3. Add every unlabeled system with which the domain can communicate.

      Unlabeled systems are of type unlabeled. The name of the security template for unlabeled systems is admin_low. Therefore, in the default configuration, an entry for an unlabeled system is similar to the following:

      192.168.35.2:admin_low

   4. Save the file, and exit the editor.

   5. Check the syntax of the file.

      # tnchkdb -h /setup/files/tnrhdb

   6. Fix any errors before continuing.

8. Copy the /setup/files/tnrhdb file to the /etc/security/tsol/tnrhdb file.

9. Use the ldapaddent command to populate the Directory Server with every file in the staging area.

   For example, the following command populates the server from the hosts file in the staging area.

   # /usr/sbin/ldapaddent -D "cn=directory manager" \ -w dirmgr123 -a simple -f /setup/files/hosts hosts

10. If you ran the ldapclient command on the Trusted Extensions Directory Server, disable the client on that system.

    In the global zone, run the ldapclient uninit command. Use verbose output to verify that the system is no longer an LDAP client.

    # ldapclient -v uninit

    For more information, see the ldapclient(1M) man page.

Creating a Trusted Extensions Proxy for an Existing Sun Java System Directory Server

First, you need to add the Trusted Extensions databases to the existing Directory Server on a Solaris system. Second, to enable Trusted Extensions systems to access the Directory Server, you then need to configure a Trusted Extensions system to be the LDAP proxy server.

Create an LDAP Proxy Server

If an LDAP server already exists at your site, create a proxy server on a Trusted Extensions system.

Before You Begin

You have populated the LDAP server from a client that was modified to set the enableShadowUpdate parameter to TRUE. For the requirement, see Create an LDAP Client for the Directory Server.

In addition, you have added the databases that contain Trusted Extensions information to the LDAP server from a client where the enableShadowUpdate parameter was set to TRUE. For details, see Populate the Sun Java System Directory Server.

1. On a system that is configured with Trusted Extensions, create a proxy server.

   ---

   Note –

   You must run two ldapclient commands. After you run the ldapclient init command, you then run the ldapclient modify command to set the enableShadowUpdate parameter to TRUE.

   ---

   For details, see Chapter 12, Setting Up LDAP Clients (Tasks), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).

2. Verify that the Trusted Extensions databases can be viewed by the proxy server.

   # ldaplist -l database

Troubleshooting

For strategies to solve LDAP configuration problems, see Chapter 13, LDAP Troubleshooting (Reference), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).

Configuring the Solaris Management Console for LDAP (Task Map)

The Solaris Management Console is the GUI for administering the network of systems that are running Trusted Extensions.

Register LDAP Credentials With the Solaris Management Console

Before You Begin

You must be the root user on an LDAP server that is running Trusted Extensions. The server can be a proxy server.

Your Sun Java System Directory Server must be configured. You have completed one of the following configurations:

• Configuring an LDAP Server on a Trusted Extensions Host (Task Map)

• Configuring an LDAP Proxy Server on a Trusted Extensions Host (Task Map)

1. Register the LDAP administrative credentials.

   LDAP-Server # /usr/sadm/bin/dtsetup storeCred Administrator DN:Type the value for cn on your system Password:Type the Directory Manager password Password (confirm):Retype the password

2. List the scopes on the Directory Server.

   LDAP-Server # /usr/sadm/bin/dtsetup scopes Getting list of manageable scopes... Scope 1 file:Displays name of file scope Scope 2 ldap:Displays name of ldap scope

   Your LDAP server setup determines the scopes that are listed. The LDAP scope is not listed until the LDAP toolbox is edited. The toolbox cannot be edited until after the server is registered.

Example 5–1 Registering LDAP Credentials

In this example, the name of the LDAP server is LDAP1 and the value for cn is the default, Directory Manager.

# /usr/sadm/bin/dtsetup storeCred
Administrator DN:cn=Directory Manager
Password:abcde1;!
Password (confirm):abcde1;!
# /usr/sadm/bin/dtsetup scopes
Getting list of manageable scopes...
Scope 1 file:/LDAP1/LDAP1
Scope 2 ldap:/LDAP1/cd=LDAP1,dc=example-domain,dc=com

Enable the Solaris Management Console to Accept Network Communications

By default, Solaris systems are not configured to listen on ports that present security risks. Therefore, you must explicitly configure any system that you plan to administer remotely to accept network communications. For example, to administer network databases on the LDAP server from a client, the Solaris Management Console server on the LDAP server must accept network communications.

For an illustration of the Solaris Management Console configuration requirements for a network with an LDAP server, see Client-Server Communication With the Solaris Management Console in Oracle Solaris Trusted Extensions Administrator’s Procedures.

Before You Begin

You must be superuser in the global zone on the Solaris Management Console server system. In this procedure, that system is called the remote system. Also, you must have command line access to the client system as superuser.

1. On the remote system, enable the system to accept remote connections.

   The smc daemon is controlled by the wbem service. If the options/tcp_listen property to the wbem service is set to true, the Solaris Management Console server accepts remote connections.

   # /usr/sbin/svcprop -p options wbem options/tcp_listen boolean false # svccfg -s wbem setprop options/tcp_listen=true

2. Refresh and restart the wbem service.

   # svcadm refresh wbem # svcadm restart wbem

3. Verify that the wbem service is set to accept remote connections.

   # svcprop -p options wbem options/tcp_listen boolean true

4. On the remote system and on any client that needs to access the Solaris Management Console, ensure that remote connections are enabled in the smcserver.config file.

   1. Open the smcserver.config file in the trusted editor.

      # /usr/dt/bin/trusted_edit /etc/smc/smcserver.config

   2. Set the remote.connections parameter to true.

      ## remote.connections=false remote.connections=true

   3. Save the file and exit the trusted editor.

Troubleshooting

If you restart or enable the wbem service, you must ensure that the remote.connections parameter in the smcserver.config file remains set to true.

Edit the LDAP Toolbox in the Solaris Management Console

Before You Begin

You must be superuser on the LDAP server. The LDAP credentials must be registered with the Solaris Management Console, and you must know the output of the /usr/sadm/bin/dtsetup scopes command. For details, see Register LDAP Credentials With the Solaris Management Console.

1. Find the LDAP toolbox.

   # cd /var/sadm/smc/toolboxes/tsol_ldap # ls *tbx tsol_ldap.tbx

2. Provide the LDAP server name.

   1. Open the trusted editor.

   2. Copy and paste the full pathname of the tsol_ldap.tbx toolbox as the argument to the editor.

      For example, the following path is the default location of the LDAP toolbox:

      /var/sadm/smc/toolboxes/tsol_ldap/tsol_ldap.tbx

   3. Replace the scope information.

      Replace the server tags between the <Scope> and </Scope> tags with the output of the ldap:/...... line from the /usr/sadm/bin/dtsetup scopes command.

      <Scope>ldap:/<ldap-server-name>/<dc=domain,dc=suffix></Scope>

   4. Replace every instance of <?server?> or <?server ?> with the LDAP server.

      <Name>This Computer (ldap-server-name: Scope=ldap, Policy=TSOL)</Name> services and configuration of ldap-server-name.</Description> and configuring ldap-server-name.</Description> ...

   5. Save the file, and exit the editor.

3. Refresh and restart the wbem service.

   # svcadm refresh wbem # svcadm restart wbem

Example 5–2 Configuring the LDAP Toolbox

In this example, the name of the LDAP server is LDAP1. To configure the toolbox, the administrator replaces the instances of <?server ?> with LDAP1.

# cd /var/sadm/smc/toolboxes/tsol_ldap
# /usr/dt/bin/trusted_edit /tsol_ldap.tbx
<Scope>ldap:/LDAP1/cd=LDAP1,dc=example-domain,dc=com</Scope

...
<Name>This Computer (LDAP1: Scope=ldap, Policy=TSOL)</Name>
services and configuration of LDAP1.</Description>
and configuring LDAP1.</Description>
...

Verify That the Solaris Management Console Contains Trusted Extensions Information

For an illustration of the Solaris Management Console configuration requirements for a network with an LDAP server and for a network without an LDAP server, see Client-Server Communication With the Solaris Management Console in Oracle Solaris Trusted Extensions Administrator’s Procedures.

Before You Begin

You must be logged in to an LDAP client in an administrative role, or as superuser. To make a system an LDAP client, see Make the Global Zone an LDAP Client in Trusted Extensions.

To administer the local system, you must have completed Initialize the Solaris Management Console Server in Trusted Extensions.

To connect to a Console server on a remote system from the local system, you must have completed Initialize the Solaris Management Console Server in Trusted Extensions on both systems. Also, on the remote system, you must have completed Enable the Solaris Management Console to Accept Network Communications.

To administer the databases in the LDAP naming service from the LDAP client, on the LDAP server you must have completed Edit the LDAP Toolbox in the Solaris Management Console, in addition to the preceding procedures.

1. Start the Solaris Management Console.

   # /usr/sbin/smc &

2. Open a Trusted Extensions toolbox.

   A Trusted Extensions toolbox has the value Policy=TSOL.

   • On a trusted network that uses LDAP as a naming service, perform the following tests:

     1. To check that local administrative databases can be accessed, open the following toolbox:

        This Computer (this-host: Scope=Files, Policy=TSOL)

     2. To check that the LDAP server's local administrative databases can be accessed, specify the following toolbox:

        This Computer (ldap-server: Scope=Files, Policy=TSOL)

     3. To check that the naming service databases on the LDAP server can be accessed, specify the following toolbox:

        This Computer (ldap-server: Scope=LDAP, Policy=TSOL)

   • On a trusted network that does not use LDAP as a naming service, perform the following tests:

     1. To check that local administrative databases can be accessed, open the following toolbox:

        This Computer (this-host: Scope=Files, Policy=TSOL)

     2. To check that a remote system's local administrative databases can be accessed, specify the following toolbox:

        This Computer (remote-system: Scope=Files, Policy=TSOL)

3. Under System Configuration, navigate to Computers and Networks, then Security Templates.

4. Check that the correct templates and labels have been applied to the remote systems.

   ---

   Note –

   When you try to access network database information from a system that is not the LDAP server, the operation fails. The Console allows you to log in to the remote host and open the toolbox. However, when you try to access or change information, the following error message indicates that you have selected Scope=LDAP on a system that is not the LDAP server:

   Management server cannot perform the operation requested. ... Error extracting the value-from-tool. The keys received from the client were machine, domain, Scope. Problem with Scope.

   ---

Troubleshooting

To troubleshoot LDAP configuration, see Chapter 13, LDAP Troubleshooting (Reference), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).