Documentation Home
> System Administration Guide: Security Services
System Administration Guide: Security Services
Book Information
Index
Numbers and Symbols
A
B
C
D
E
F
G
H
I
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Preface
Chapter 1 Security Services (Overview)
Introduction to Security Services
Authentication
Access Control
Secure Communication
Auditing
Chapter 2 Authentication Services Topics
Chapter 3 Using Authentication Services (Tasks)
Overview of Secure RPC
NFS Services and Secure RPC
DES Encryption
Kerberos Authentication
Diffie-Hellman Authentication
Implementation of Diffie-Hellman Authentication
Generating the Public Keys and Secret Keys
Running the keylogin Command
Generating the Conversation Key
First Contact With the Server
Decrypting the Conversation Key
Storing Information on the Server
Returning the Verifier to the Client
Client Authenticates the Server
Additional Transactions
Administering Diffie-Hellman Authentication
How to Restart the Keyserver
How to Set Up a Key in NIS+ Credentials for Diffie-Hellman Authentication
Example—Setting Up a New Key for root on a NIS+ Client
How to Set Up a New User Key That Uses NIS+ Credentials for Diffie-Hellman Authentication
Example—Setting Up a New Key for an NIS+ User
How to Set Up a root Key by Using NIS Credentials With Diffie-Hellman Authentication
Example—Setting Up an NIS+ Client to Use Diffie-Hellman Security
How to Create a New User Key That Uses NIS Credentials with Diffie-Hellman Authentication
How to Share and Mount Files With Diffie-Hellman Authentication
PAM (Overview)
Benefits of Using PAM
PAM Components
PAM Library
Stacking Feature
Password-Mapping Feature
Changes to PAM for the Solaris 9 Release
PAM (Tasks)
PAM (Task Map)
Planning for PAM
How to Add a PAM Module
Verification
How to Prevent Unauthorized Access From Remote Systems With PAM
How to Initiate PAM Error Reporting
Example—Initiating PAM Error Reporting
PAM (Reference)
PAM Modules
PAM Module Types
PAM Configuration File
PAM Configuration File Syntax
Valid Service Names
Control Flags
Generic pam.conf File
Chapter 4 Using Secure Shell (Tasks)
Introduction to Secure Shell
Using Secure Shell (Task Map)
Using Secure Shell
How to Create a Public/Private Key Pair
How to Log In to Another Host with Secure Shell
How to Log in With No Password While Using ssh-agent
Example—Using ssh-add Options
How to Set ssh-agent to Run Automatically
How to Use Secure Shell Port Forwarding
Example — Using Local Port Forwarding to Receive Mail
Example — Using Remote Port Forwarding to Communicate Outside of a Firewall
How to Copy Files With Secure Shell
Transferring Files Remotely Using sftp
How to Set Up Default Connections to Hosts Outside a Firewall
Example — Connecting to Hosts Outside a Firewall From the Command Line
Chapter 5 Secure Shell Administration (Reference)
A Typical Secure Shell Session
Session Characteristics
Authentication
Command Execution and Data Forwarding
Configuring the Secure Shell
Secure Shell Client Configuration
Host-Specific Parameters
Client-Side Authentication Parameters
Known Host File Parameters
Client-Side X11 Forwarding and Port Forwarding Parameters
Client-Side Connection and Other Parameters
Secure Shell Server Configuration
Server-Side Authentication Parameters
Ports and Forwarding Parameters
Session Control Parameters
Server Connection and Other Parameters
Maintaining Known Hosts on a Site-Wide Basis
Secure Shell Files
Chapter 6 Introduction to SEAM
What Is SEAM?
How SEAM Works
Initial Authentication: the Ticket-Granting Ticket
Subsequent Authentications
Principals
Realms
Realms and Servers
SEAM Security Services
SEAM Releases
SEAM 1.0 Components
SEAM Components in the Solaris 8 Release
SEAM 1.0.1 Components
SEAM Components in the Solaris 9 Release
Chapter 7 Planning for SEAM
Why Plan for SEAM?
Realms
Realm Names
Number of Realms
Realm Hierarchy
Mapping Host Names Onto Realms
Client and Service Principal Names
Ports for the KDC and Admin Services
Slave KDCs
Database Propagation
Clock Synchronization
Online Help URL
Chapter 8 Configuring SEAM (Tasks)
Configuring SEAM (Task Map)
Configuring KDC Servers
How to Configure a Master KDC
How to Configure a Slave KDC
Configuring Cross-Realm Authentication
How to Establish Hierarchical Cross-Realm Authentication
How to Establish Direct Cross-Realm Authentication
Configuring SEAM NFS Servers
How to Configure SEAM NFS Servers
How to Create a Credential Table
How to Add a Single Entry to the Credential Table
Example—Adding a Single Entry to the Credential Table
How to Set Up a Secure NFS Environment With Multiple Kerberos Security Modes
Example—Sharing a File System With One Kerberos Security Mode
Example—Sharing a File System With Multiple Kerberos Security Modes
Configuring SEAM Clients
How to Configure a SEAM Client
Example-Setting Up a SEAM Client Using a Non-SEAM KDC
Setting Up Root Authentication to Mount NFS File Systems
Synchronizing Clocks between KDCs and SEAM Clients
Swapping a Master KDC and a Slave KDC
How to Configure a Swappable Slave KDC
How to Swap a Master KDC and a Slave KDC
Administering the Kerberos Database
Backing Up and Propagating the Kerberos Database
The kpropd.acl File
The kprop_script Command
How to Back Up the Kerberos Database
Example—Backing Up the Kerberos Database
How to Restore the Kerberos Database
Example—Restoring the Kerberos Database
How to Manually Propagate the Kerberos Database to the Slave KDCs
Setting Up Parallel Propagation
How to Set Up Parallel Propagation
Example—Setting Up Parallel Propagation
Administering the Stash File
How to Remove a Stash File
Increasing Security
How to Restrict Access to KDC Servers
Chapter 9 SEAM Error Messages and Troubleshooting
SEAM Error Messages
SEAM Administration Tool Error Messages
Common SEAM Error Messages (A-M)
Common SEAM Error Messages (N-Z)
SEAM Troubleshooting
Problems Mounting a Kerberized NFS File System
Problems Authenticating as root
Chapter 10 Administering Principals and Policies (Tasks)
Ways to Administer Principals and Policies
SEAM Administration Tool
Command-Line Equivalents of the SEAM Tool
Files Modified by the SEAM Tool
Print and Online Help Features of the SEAM Tool
Working With Large Lists in the SEAM Tool
How to Start the SEAM Tool
Administering Principals
Administering Principals (Task Map)
Automating the Creation of New Principals
How to View the List of Principals
Example—Viewing the List of Principals (Command Line)
How to View a Principal's Attributes
Example—Viewing a Principal's Attributes
Example—Viewing a Principal's Attributes (Command Line)
How to Create a New Principal
Example—Creating a New Principal
Example—Creating a New Principal (Command Line)
How to Duplicate a Principal
How to Modify a Principal
Example—Modifying a Principal's Password (Command Line)
How to Delete a Principal
Example—Deleting a Principal (Command Line)
How to Set Up Defaults for Creating New Principals
How to Modify the Kerberos Administration Privileges
Example—Modifying the Kerberos Administration Privileges
Administering Policies
Administering Policies (Task Map)
How to View the List of Policies
Example—Viewing the List of Policies (Command Line)
How to View a Policy's Attributes
Example—Viewing a Policy's Attributes
Example—Viewing a Policy's Attributes (Command Line)
How to Create a New Policy
Example—Creating a New Policy
Example—Creating a New Policy (Command Line)
How to Duplicate a Policy
How to Modify a Policy
Example—Modifying a Policy (Command Line)
How to Delete a Policy
Example—Deleting a Policy (Command Line)
SEAM Tool Reference
SEAM Tool Panel Descriptions
Using the SEAM Tool With Limited Kerberos Administration Privileges
Administering Keytab Files
Administering Keytabs Task Map
How to Add a Service Principal to a Keytab File
Example—Adding a Service Principal to a Keytab File
How to Remove a Service Principal From a Keytab File
Example—Removing a Service Principal From a Keytab
How to Display the Keylist (Principals) in a Keytab File
Example—Displaying the Keylist (Principals) in a Keytab File
How to Temporarily Disable Authentication for a Service on a Host
Example—Temporarily Disabling a Service on a Host
Chapter 11 Using SEAM (Tasks)
Ticket Management
Do You Need to Worry About Tickets?
How to Create a Ticket
Example—Creating a Ticket
How to View Tickets
Example—Viewing Tickets
How to Destroy Tickets
Password Management
Advice on Choosing a Password
Changing Your Password
Examples—Changing Your Password
Chapter 12 SEAM (Reference)
SEAM Files
PAM Configuration File
SEAM Commands
SEAM Daemons
SEAM Terminology
Kerberos-Specific Terminology
Authentication-Specific Terminology
Types of Tickets
Ticket Lifetimes
Principal Names
How the Authentication System Works
Gaining Access to a Service Using SEAM
Obtaining a Credential for the Ticket-Granting Service
Obtaining a Credential for a Server
Obtaining Access to a Specific Service
Using the gsscred Table
Chapter 13 Managing System Security Topics
Chapter 14 Managing System Security (Overview)
Controlling Access to a Computer System
Maintaining Physical Site Security
Maintaining Login Control
Restricting Access to Data in Files
Maintaining Network Control
Monitoring System Usage
Setting the Correct Path
Securing Files
Installing a Firewall
Reporting Security Problems
File Security
Commands for File System Security
File Encryption
Access Control Lists (ACLs)
System Security
Login Access Restrictions
Special Logins
Managing Password Information
NIS+ Password File
NIS Password File
/etc Files
LDAP Password Information
Using the Restricted Shell
Tracking Superuser (Root) Login
Monitoring Who is Becoming Superuser or Other Users
Network Security
Firewall Systems
Packet Smashing
Authentication and Authorization
Sharing Files
Restricting Superuser (Root) Access
Using Privileged Ports
Using the Automated Security Enhancement Tool (ASET)
Chapter 15 Securing Files (Tasks)
File Security Features
User Classes
File Permissions
Directory Permissions
Special File Permissions (setuid, setgid and Sticky Bit)
setuid Permission
setgid Permission
Sticky Bit
Default umask Setting
Displaying File Information
How to Display File Information
Example—Displaying File Information
Changing File Ownership
How to Change the Owner of a File
Example—Changing the Owner of a File
How to Change Group Ownership of a File
Example—Changing Group Ownership of a File
Changing File Permissions
How to Change Permissions in Absolute Mode
Example—Changing Permissions in Absolute Mode
How to Change Special Permissions in Absolute Mode
Examples—Setting Special Permissions in Absolute Mode
How to Change Permissions in Symbolic Mode
Examples—Changing Permissions in Symbolic Mode
Searching for Special Permissions
How to Find Files With setuid Permissions
Example—Finding Files With setuid Permissions
Executable Stacks and Security
How to Disable Programs From Using Executable Stacks
How to Disable Executable Stack Message Logging
Using Access Control Lists (ACLs)
ACL Entries for Files
ACL Entries for Directories
How to Set an ACL on a File
Examples—Setting an ACL on a File
How to Copy an ACL
Example—Copying an ACL
How to Check If a File Has an ACL
Example—Checking If a File Has an ACL
How to Modify ACL Entries on a File
Examples—Modifying ACL Entries on a File
How to Delete ACL Entries From a File
Example—Deleting ACL Entries on a File
How to Display ACL Entries for a File
Examples—Displaying ACL Entries for a File
Chapter 16 Securing Systems (Tasks)
Displaying User Login Information
How to Display a User's Login Status
Example—Displaying a User's Login Status
How to Display Users Without Passwords
Example—Displaying Users Without Passwords
Temporarily Disabling User Logins
Creating the /etc/nologin File
How to Temporarily Disable User Logins
Example—Disabling User Logins
Saving Failed Login Attempts
How to Save Failed Login Attempts
Password Protection Using Dial-up Passwords
How to Create a Dial-up Password
How to Temporarily Disable Dial-up Logins
Restricting Superuser (root) Access on the Console
How to Restrict Superuser (root) Login to the Console
Monitoring Who Is Using the su Command
How to Monitor Who Is Using the su Command
How to Display Superuser (root) Access Attempts to the Console
Modifying a System's Abort Sequence
How to Disable or Enable a System's Abort Sequence
Chapter 17 Role-Based Access Control (Overview)
RBAC: Replacing the Superuser Model
Solaris RBAC Elements
Privileged Applications
Applications That Check UIDs and GIDs
Applications That Check Authorizations
Profile Shell
RBAC Roles
RBAC Authorizations
RBAC Rights Profiles
Name Service Scope
Chapter 18 Role-Based Access Control (Tasks)
Configuring RBAC (Task Map)
Planning for RBAC
First-Time Use of the User Tool Collection
Setting Up Initial Users
Setting Up Initial Roles
Making Root a Role
How to Make Root a Role
Managing RBAC Information (Task Map)
Using Privileged Applications
Creating Roles
Changing Role Properties
Creating or Changing a Rights Profile
Modifying a User's RBAC Properties
Securing Legacy Applications
How to Add Security Attributes to a Legacy Application
How to Add Security Attributes to Commands in a Script
How to Check for Authorizations in a Script or Program
Chapter 19 Role-Based Access Control (Reference)
RBAC Elements: Reference Information
Configuring Recommended Roles
Contents of Rights Profiles
All Rights Profile
Primary Administrator Rights Profile
System Administrator Rights Profile
Operator Rights Profile
Basic Solaris User Rights Profile for User
Printer Management Rights Profile
Authorizations
Authorization Naming Convention
Example of Authorization Granularity
Delegating Authorizations
Databases That Support RBAC
RBAC Database Relationships
The user_attr Database
The auth_attr Database
The prof_attr Database
The exec_attr Database
The policy.conf File
RBAC Commands
Command-Line Applications for Managing RBAC
Commands That Require Authorizations
Chapter 20 Using the Automated Security Enhancement Tool (Tasks)
Automated Security Enhancement Tool (ASET)
ASET Security Levels
ASET Tasks
System Files Permissions Tuning
System Files Checks
User and Group Checks
System Configuration Files Check
Environment Variables Check
eeprom Check
Firewall Setup
ASET Execution Log
Example of an ASET Execution Log File
ASET Reports
Format of ASET Report Files
Examining ASET Report Files
Comparing ASET Report Files
ASET Master Files
Tune Files
The uid_aliases File
The Checklist Files
ASET Environment File (asetenv)
Configuring ASET
Modifying the Environment File (asetenv)
Choose Which Tasks to Run: TASKS
Specify Directories for System Files Checks Task: CKLISTPATH
Schedule ASET Execution: PERIODIC_SCHEDULE
Specify an Aliases File: UID_ALIASES
Extend Checks to NIS+ Tables: YPCHECK
Modifying the Tune Files
Restoring System Files Modified by ASET
Network Operation With the NFS System
Providing a Global Configuration for Each Security Level
Collecting ASET Reports
ASET Environment Variables
ASETDIR Environment Variable
ASETSECLEVEL Environment Variable
PERIODIC_SCHEDULE Environment Variable
TASKS Environment Variable
UID_ALIASES Environment Variable
YPCHECK Environment Variable
CKLISTPATH_level Environment Variable
ASET File Examples
Tune Files
Aliases File
Running ASET
How to Run ASET Interactively
Example—Running ASET Interactively
How to Run ASET Periodically
How to Stop Running ASET Periodically
How to Collect ASET Reports on a Server
Troubleshooting ASET Problems
ASET Error Messages
Chapter 21 Auditing Topics
Chapter 22 BSM (Overview)
What Is Auditing?
How Does Auditing Work?
How Is Auditing Related to Security?
BSM Terminology
Audit Events
Kernel-Level Audit Events
User-Level Audit Events
Nonattributable Audit Events
Audit Classes
Audit Flags
Audit Records
Audit Directory
Device Allocation
Chapter 23 Audit Planning
Handling the Audit Trail
Deciding Who and What to Audit
Determining Which Audit Policies to Use
Controlling Auditing Costs
Cost of Increased Processing Time
Cost of Analysis
Cost of Storage
Auditing Efficiently
Chapter 24 Managing the BSM Service (Tasks)
Managing BSM (Task Map)
Configuring Audit Files
Configuring Audit Files (Task Map)
How to Change Audit Flags
Example — Changing Audit Trail File Locations
Example — Changing Audit Flags for All Users
Example — Changing the Soft Limit for Warnings
Example — Changing Auditing of Nonattributable Events
How to Change Users' Audit Characteristics
Example — Changing Auditing for One User
Example — Creating an Audit Admin Login
How to Change Audit Classes
Example — Setting a New Audit Class
How to Change Audit Events
Example — Adding a New Audit Event
Configuring the Audit Service
Configuring the Audit Service (Task Map)
How to Create Partitions for Auditing
Example — Creating an Audit Directory of Last Resort
Example — Creating New Audit Partitions
How to Configure the audit_warn Alias
How to Enable or Disable an Audit Policy
Example — Setting the cnt Policy
How to Enable Auditing
How to Disable Auditing
Managing Audit Records
Managing Audit Records (Task Map)
How to Merge Audit Records
Example — Displaying the Entire Audit Trail
Example — Printing the Entire Audit Trail
Example — Combining and Reducing Audit Files
Example — Displaying User Activity From a Selected Date
Example — Copying Selected Records to a Single File
Example — Cleaning Up a not_terminated Audit File
How to Display Audit Record Formats
Example — Displaying the Format of an Audit Record
How to Prevent Audit Trail Overflow
Managing Device Allocation
Adding an Allocatable Device (Task Map)
How to Set Up Lock Files for an Allocatable Device
How to Change Which Devices Can Be Allocated
How to Allocate a Device
Example — Allocating a Printer
How to Deallocate a Device
Example — Deallocating a Printer
Example — Forcing a Deallocation
Example — Deallocating All Devices
Chapter 25 BSM Services Reference
Audit Commands
The Audit Daemon
The audit Command
The auditreduce Command
The praudit Command
The auditconfig Command
Audit Files
The /etc/system File
The audit_class File
The audit_control File
Sample audit_control File
The audit_data File
The audit_event File
The audit_startup Script
The audit_user File
The audit_warn Script
Audit Flags
Definitions of Audit Flags
Audit Flag Syntax
Prefixes to Modify Audit Flags
Audit Policies
Process Audit Characteristics
Audit Trail
More About the Audit Files
Audit File Naming
How Audit File Names Are Used
Time-Stamp Format and Interpretation
Example of a File Name for a Still-Active File
Example of a Closed Audit File Name
Audit Record Structure
Audit Token Formats
acl Token
arbitrary Token
arg Token
attr Token
exec_args Token
exec_env Token
exit Token
file Token
groups Token (Obsolete)
header Token
in_addr Token
ip Token
ipc Token
ipc_perm Token
iport Token
newgroups Token
opaque Token
path Token
process Token
return Token
seq Token
socket Token
subject Token
text Token
trailer Token
Device Allocation Reference
Components of the Device-Allocation Mechanism
Using the Device-Allocation Commands
The Allocate Error State
The device_maps File
The device_allocate File
Device-Clean Scripts
Object Reuse
Device-Clean Script for Tapes
Device-Clean Scripts for Diskettes and CD-ROM Devices
Device-Clean Script for Audio
Writing New Device-Clean Scripts
How the Device-Allocation Mechanism Works
Glossary
© 2010, Oracle Corporation and/or its affiliates