Documentation Home
> System Administration Guide: Security Services
System Administration Guide: Security Services
Book Information
Index
Numbers and Symbols
A
B
C
D
E
F
G
H
I
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Preface
Part I Security Overview
Chapter 1 Security Services (Overview)
Introduction to Security Services
Machine Security
Authentication Services
Secure Communication
Auditing and Device Management
Part II Managing System Security
Chapter 2 Managing Machine Security (Overview)
Controlling Access to a Computer System
Maintaining Physical Security
Maintaining Login Control
Managing Password Information
Local Passwords
NIS and NIS+ Passwords
LDAP Passwords
Password Encryption
Algorithms Configuration in the policy.conf File
Special System Logins
Remote Logins
Dial-up Logins
Controlling Access to Machine Resources
Limiting and Monitoring Superuser
Configuring Role-Based Access Control to Replace root
Preventing Unintentional Misuse of Machine Resources
Setting the Path Variable
Assigning a Restricted Shell
Restricting Access to Data in Files
Restricting setuid Executable Files
Using the Automated Security Enhancement Tool (ASET)
Using the Resource Manager
Monitoring Use of Machine Resources
Controlling Access to Files
Commands for File System Security
File Encryption
Access Control Lists (ACLs)
Sharing Files Across Machines
Restricting root Access to Shared Files
Controlling Network Access
Network Security Mechanisms
Authentication and Authorization for Remote Access
Using Privileged Ports Between Solaris Systems
Firewall Systems
Packet Smashing
Reporting Security Problems
Chapter 3 Securing Machines (Tasks)
Securing Machines (Task Map)
Securing Logins and Passwords
How to Display a User's Login Status
Example—Displaying a User's Login Status
How to Display Users Without Passwords
Example—Displaying Users Without Passwords
How to Temporarily Disable User Logins
Example—Disabling User Logins
How to Save Failed Login Attempts
How to Create a Dial-up Password
How to Temporarily Disable Dial-up Logins
Changing the Default Algorithm for Password Encryption
How to Specify an Algorithm for Password Encryption
Example—Using the Blowfish Algorithm for Password Encryption
How to Specify a New Password Algorithm for an NIS+ Domain
How to Specify a New Password Algorithm for an NIS Domain
How to Specify a New Password Algorithm for an LDAP Domain
How to Install a Password Encryption Module From a Third Party
Monitoring and Restricting Superuser
How to Monitor Who Is Using the su Command
How to Display Superuser (root) Access Attempts to the Console
How to Prevent Remote Login by Superuser (root)
Securing the Hardware
How to Require a Password for Hardware Access
How to Disable or Enable a System's Abort Sequence
Chapter 4 Securing Files (Tasks)
File Security Features
User Classes
File Permissions
Directory Permissions
Special File Permissions (setuid, setgid and Sticky Bit)
setuid Permission
setgid Permission
Sticky Bit
Default umask Setting
Displaying File Information
How to Display File Information
Example—Displaying File Information
Changing File Ownership
How to Change the Owner of a File
Example—Changing the Owner of a File
How to Change Group Ownership of a File
Example—Changing Group Ownership of a File
Changing File Permissions
How to Change Permissions in Absolute Mode
Example—Changing Permissions in Absolute Mode
How to Change Special Permissions in Absolute Mode
Examples—Setting Special Permissions in Absolute Mode
How to Change Permissions in Symbolic Mode
Examples—Changing Permissions in Symbolic Mode
Searching for Special Permissions
How to Find Files With setuid Permissions
Example—Finding Files With setuid Permissions
Executable Stacks and Security
How to Disable Programs From Using Executable Stacks
How to Disable Executable Stack Message Logging
Using Access Control Lists (ACLs)
ACL Entries for Files
ACL Entries for Directories
How to Set an ACL on a File
Examples—Setting an ACL on a File
How to Copy an ACL
Example—Copying an ACL
How to Check If a File Has an ACL
Example—Checking If a File Has an ACL
How to Modify ACL Entries on a File
Examples—Modifying ACL Entries on a File
How to Delete ACL Entries From a File
Example—Deleting ACL Entries on a File
How to Display ACL Entries for a File
Examples—Displaying ACL Entries for a File
Chapter 5 Role-Based Access Control (Overview)
RBAC: Replacing the Superuser Model
Solaris RBAC Elements
Privileged Applications
Applications That Check UIDs and GIDs
Applications That Check Authorizations
Profile Shell
RBAC Roles
RBAC Authorizations
RBAC Rights Profiles
Name Service Scope
Chapter 6 Role-Based Access Control (Tasks)
Configuring RBAC (Task Map)
Planning for RBAC
First-Time Use of the User Tool Collection
Setting Up Initial Users
Setting Up Initial Roles
Making Root a Role
How to Make Root a Role
Managing RBAC Information (Task Map)
Using Privileged Applications
Creating Roles
Changing Role Properties
Creating or Changing a Rights Profile
Modifying a User's RBAC Properties
Securing Legacy Applications
How to Add Security Attributes to a Legacy Application
How to Add Security Attributes to Commands in a Script
How to Check for Authorizations in a Script or Program
Chapter 7 Role-Based Access Control (Reference)
RBAC Elements: Reference Information
Configuring Recommended Roles
Contents of Rights Profiles
All Rights Profile
Primary Administrator Rights Profile
System Administrator Rights Profile
Operator Rights Profile
Basic Solaris User Rights Profile for User
Printer Management Rights Profile
Authorizations
Authorization Naming Convention
Example of Authorization Granularity
Delegating Authorizations
Databases That Support RBAC
RBAC Database Relationships
The user_attr Database
The auth_attr Database
The prof_attr Database
The exec_attr Database
The policy.conf File
RBAC Commands
Command-Line Applications for Managing RBAC
Commands That Require Authorizations
Chapter 8 Using the Automated Security Enhancement Tool (Tasks)
Automated Security Enhancement Tool (ASET)
ASET Security Levels
ASET Tasks
System Files Permissions Tuning
System Files Checks
User and Group Checks
System Configuration Files Check
Environment Variables Check
eeprom Check
Firewall Setup
ASET Execution Log
Example of an ASET Execution Log File
ASET Reports
Format of ASET Report Files
Examining ASET Report Files
Comparing ASET Report Files
ASET Master Files
Tune Files
The uid_aliases File
The Checklist Files
ASET Environment File (asetenv)
Configuring ASET
Modifying the Environment File (asetenv)
Choose Which Tasks to Run: TASKS
Specify Directories for System Files Checks Task: CKLISTPATH
Schedule ASET Execution: PERIODIC_SCHEDULE
Specify an Aliases File: UID_ALIASES
Extend Checks to NIS+ Tables: YPCHECK
Modifying the Tune Files
Restoring System Files Modified by ASET
Network Operation With the NFS System
Providing a Global Configuration for Each Security Level
Collecting ASET Reports
ASET Environment Variables
ASETDIR Environment Variable
ASETSECLEVEL Environment Variable
PERIODIC_SCHEDULE Environment Variable
TASKS Environment Variable
UID_ALIASES Environment Variable
YPCHECK Environment Variable
CKLISTPATH_level Environment Variable
ASET File Examples
Tune Files
Aliases File
Running ASET
How to Run ASET Interactively
Example—Running ASET Interactively
How to Run ASET Periodically
How to Stop Running ASET Periodically
How to Collect ASET Reports on a Server
Troubleshooting ASET Problems
ASET Error Messages
Part III Authentication Services and Secure Communication
Chapter 9 Using Authentication Services (Tasks)
Overview of Secure RPC
NFS Services and Secure RPC
DES Encryption
Kerberos Authentication
Diffie-Hellman Authentication
Implementation of Diffie-Hellman Authentication
Generating the Public Keys and Secret Keys
Running the keylogin Command
Generating the Conversation Key
First Contact With the Server
Decrypting the Conversation Key
Storing Information on the Server
Returning the Verifier to the Client
Client Authenticates the Server
Additional Transactions
Administering Diffie-Hellman Authentication
How to Restart the Keyserver
How to Set Up a root Key in NIS+ Credentials for Diffie-Hellman Authentication
Example—Setting Up a New Key for root on an NIS+ Client
How to Set Up a New User Key That Uses NIS+ Credentials for Diffie-Hellman Authentication
Example—Setting Up a New Key for an NIS+ User
How to Set Up a root Key by Using NIS Credentials With Diffie-Hellman Authentication
Example—Setting Up a New Key for root on a NIS Client
How to Create a New User Key That Uses NIS Credentials With Diffie-Hellman Authentication
How to Share and Mount Files With Diffie-Hellman Authentication
Chapter 10 Using PAM
PAM (Overview)
Benefits of Using PAM
PAM Components
PAM Library
Password-Mapping Feature
Changes to PAM for the Solaris 9 Release
Changes to PAM for the Solaris 9 Update 2 Release
PAM (Tasks)
PAM (Task Map)
Planning for PAM
How to Add a PAM Module
Verification
How to Prevent Unauthorized Access From Remote Systems With PAM
How to Initiate PAM Error Reporting
Example—Initiating PAM Error Reporting
PAM (Reference)
PAM Modules
PAM Module Types
PAM Configuration File
PAM Configuration File Syntax
Valid Service Names for PAM
PAM Control Flags
Generic pam.conf File
Chapter 11 Using Solaris Secure Shell (Tasks)
Introduction to Solaris Secure Shell
Using Solaris Secure Shell (Task Map)
Using Solaris Secure Shell
How to Create a Public/Private Key Pair
How to Log In to Another Host With Solaris Secure Shell
How to Log In With No Password With the ssh-agent Command
Example—Using ssh-add Options
How to Set Up the ssh-agent Command to Run Automatically
How to Use Solaris Secure Shell Port Forwarding
Example—Using Local Port Forwarding to Receive Mail
Example—Using Remote Port Forwarding to Communicate Outside of a Firewall
How to Copy Files With Solaris Secure Shell
How to Transfer Files Remotely With the sftp Command
How to Set Up Default Connections to Hosts Outside a Firewall
Example—Connecting to Hosts Outside a Firewall From the Command Line
Chapter 12 Solaris Secure Shell Administration (Reference)
A Typical Solaris Secure Shell Session
Session Characteristics
Authentication
Command Execution and Data Forwarding
Configuring the Solaris Secure Shell
Solaris Secure Shell Client Configuration
Host-Specific Parameters
Client-Side Authentication Parameters
Known Host File Parameters
Client-Side X11 Forwarding and Port Forwarding Parameters
Client-Side Connection and Other Parameters
Solaris Secure Shell Server Configuration
Server-Side Authentication Parameters
Ports and Forwarding Parameters
Session Control Parameters
Server Connection and Other Parameters
Maintaining Known Hosts on a Site-Wide Basis
Solaris Secure Shell Files
Chapter 13 Introduction to SEAM
What Is SEAM?
How SEAM Works
Initial Authentication: the Ticket-Granting Ticket
Subsequent Authentications
The SEAM Remote Applications
Principals
Realms
Realms and Servers
SEAM Security Services
SEAM Releases
SEAM 1.0 Components
SEAM Components in the Solaris 8 Release
SEAM 1.0.1 Components
SEAM Components in the Solaris 9 Release
SEAM 1.0.2 Components
Chapter 14 Planning for SEAM
Why Plan for SEAM?
Realms
Realm Names
Number of Realms
Realm Hierarchy
Mapping Host Names Onto Realms
Client and Service Principal Names
Ports for the KDC and Admin Services
Slave KDCs
Database Propagation
Clock Synchronization
Online Help URL
Chapter 15 Configuring SEAM (Tasks)
Configuring SEAM (Task Map)
Configuring KDC Servers
How to Configure a Master KDC
How to Configure a Slave KDC
Configuring Cross-Realm Authentication
How to Establish Hierarchical Cross-Realm Authentication
How to Establish Direct Cross-Realm Authentication
Configuring SEAM NFS Servers
How to Configure SEAM NFS Servers
How to Create a Credential Table
How to Add a Single Entry to the Credential Table
Example—Adding a Single Entry to the Credential Table
How to Set Up a Secure NFS Environment With Multiple Kerberos Security Modes
Example—Sharing a File System With One Kerberos Security Mode
Example—Sharing a File System With Multiple Kerberos Security Modes
Configuring SEAM Clients
How to Configure a SEAM Client
Example—Setting Up a SEAM Client Using a Non-SEAM KDC
Setting Up Root Authentication to Mount NFS File Systems
Synchronizing Clocks between KDCs and SEAM Clients
Swapping a Master KDC and a Slave KDC
How to Configure a Swappable Slave KDC
How to Swap a Master KDC and a Slave KDC
Administering the Kerberos Database
Backing Up and Propagating the Kerberos Database
The kpropd.acl File
The kprop_script Command
How to Back Up the Kerberos Database
Example—Backing Up the Kerberos Database
How to Restore the Kerberos Database
Example—Restoring the Kerberos Database
How to Manually Propagate the Kerberos Database to the Slave KDCs
Setting Up Parallel Propagation
How to Set Up Parallel Propagation
Example—Setting Up Parallel Propagation
Administering the Stash File
How to Remove a Stash File
Increasing Security
How to Restrict Access to KDC Servers
Chapter 16 SEAM Error Messages and Troubleshooting
SEAM Error Messages
SEAM Administration Tool Error Messages
Common SEAM Error Messages (A-M)
Common SEAM Error Messages (N-Z)
SEAM Troubleshooting
Problems Mounting a Kerberized NFS File System
Problems Authenticating as root
Chapter 17 Administering Principals and Policies (Tasks)
Ways to Administer Principals and Policies
SEAM Administration Tool
Command-Line Equivalents of the SEAM Tool
Files Modified by the SEAM Tool
Print and Online Help Features of the SEAM Tool
Working With Large Lists in the SEAM Tool
How to Start the SEAM Tool
Administering Principals
Administering Principals (Task Map)
Automating the Creation of New Principals
How to View the List of Principals
Example—Viewing the List of Principals (Command Line)
How to View a Principal's Attributes
Example—Viewing a Principal's Attributes
Example—Viewing a Principal's Attributes (Command Line)
How to Create a New Principal
Example—Creating a New Principal
Example—Creating a New Principal (Command Line)
How to Duplicate a Principal
How to Modify a Principal
Example—Modifying a Principal's Password (Command Line)
How to Delete a Principal
Example—Deleting a Principal (Command Line)
How to Set Up Defaults for Creating New Principals
How to Modify the Kerberos Administration Privileges
Example—Modifying the Kerberos Administration Privileges
Administering Policies
Administering Policies (Task Map)
How to View the List of Policies
Example—Viewing the List of Policies (Command Line)
How to View a Policy's Attributes
Example—Viewing a Policy's Attributes
Example—Viewing a Policy's Attributes (Command Line)
How to Create a New Policy
Example—Creating a New Policy
Example—Creating a New Policy (Command Line)
How to Duplicate a Policy
How to Modify a Policy
Example—Modifying a Policy (Command Line)
How to Delete a Policy
Example—Deleting a Policy (Command Line)
SEAM Tool Reference
SEAM Tool Panel Descriptions
Using the SEAM Tool With Limited Kerberos Administration Privileges
Administering Keytab Files
Administering Keytabs Task Map
How to Add a Service Principal to a Keytab File
Example—Adding a Service Principal to a Keytab File
How to Remove a Service Principal From a Keytab File
Example—Removing a Service Principal From a Keytab
How to Display the Keylist (Principals) in a Keytab File
Example—Displaying the Keylist (Principals) in a Keytab File
How to Temporarily Disable Authentication for a Service on a Host
Example—Temporarily Disabling a Service on a Host
Chapter 18 Using SEAM (Tasks)
Ticket Management
Do You Need to Worry About Tickets?
How to Create a Ticket
Example—Creating a Ticket
How to View Tickets
Example—Viewing Tickets
How to Destroy Tickets
Password Management
Advice on Choosing a Password
Changing Your Password
Examples—Changing Your Password
Chapter 19 SEAM (Reference)
SEAM Files
PAM Configuration File
SEAM Commands
SEAM Daemons
SEAM Terminology
Kerberos-Specific Terminology
Authentication-Specific Terminology
Types of Tickets
Ticket Lifetimes
Principal Names
How the Authentication System Works
Gaining Access to a Service Using SEAM
Obtaining a Credential for the Ticket-Granting Service
Obtaining a Credential for a Server
Obtaining Access to a Specific Service
Using the gsscred Table
Part IV Auditing and Device Management
Chapter 20 BSM (Overview)
What Is Auditing?
How Does Auditing Work?
How Is Auditing Related to Security?
BSM Terminology
Audit Events
Kernel-Level Audit Events
User-Level Audit Events
Nonattributable Audit Events
Audit Classes
Audit Flags
Audit Records and Audit Tokens
Audit Directory
Device Allocation
Chapter 21 Audit Planning
Handling the Audit Trail
Deciding Who and What to Audit
Determining Which Audit Policies to Use
Controlling Auditing Costs
Cost of Increased Processing Time of Audit Data
Cost of Analysis of Audit Data
Cost of Storage of Audit Data
Auditing Efficiently
Chapter 22 Managing the BSM Service (Tasks)
Managing the BSM Service (Task Map)
Configuring Audit Files (Task Map)
How to Select Audit Flags
Example—Changing the Location of the Audit Trail File
Example—Changing Audit Flags for All Users
Example—Changing the Soft Limit for Warnings
Example—Changing Auditing of Nonattributable Events
How to Change Users' Audit Characteristics
Example—Changing Auditing for One User
Example—Creating an Audit Admin Login
How to Add Audit Classes
Example—Setting a New Audit Class
How to Change an Audit Event's Class Membership
Example—Creating a Site-Specific Audit Event Mapping
How to Add Audit Events
Example—Adding a New Audit Event
Configuring the Auditing Service (Task Map)
How to Create Partitions for Auditing
Example—Creating an Audit Directory of Last Resort
Example—Creating New Audit Partitions
How to Configure the audit_warn Alias
How to Enable or Disable an Audit Policy
Example—Setting the cnt Policy
How to Enable Auditing
How to Disable Auditing
Managing Audit Records (Task Map)
How to Display Audit Record Formats
Example—Displaying the Audit Record Formats of a Program
Example—Displaying the Audit Record Formats of an Audit Class
How to Merge Audit Records
Example—Displaying the Entire Audit Trail
Example—Printing the Entire Audit Trail
Example—Combining and Reducing Audit Files
Example—Displaying User Activity From a Selected Date
Example—Copying Selected Records to a Single File
Example—Cleaning Up a not_terminated Audit File
How to Display Audit Records
Example—Putting Audit Records in XML Format
How to Prevent Audit Trail Overflow
Managing Device Allocation (Tasks)
Adding an Allocatable Device (Task Map)
How to Set Up Lock Files for an Allocatable Device
How to Change Which Devices Can Be Allocated
How to Allocate a Device
Example—Allocating a Printer
How to Deallocate a Device
Example—Deallocating a Printer
Example—Forcing a Deallocation
Example—Deallocating All Devices
Chapter 23 BSM Service (Reference)
Audit Commands
The Audit Daemon
The audit Command
The bsmrecord Command
The auditreduce Command
The praudit Command
Example—Processing praudit Output With a Script
The auditconfig Command
Audit Service Files
The /etc/system File
The audit_class File
The audit_control File
Sample audit_control File
The audit_data File
The audit_event File
The audit_startup Script
The audit_user File
The audit_warn Script
Audit Administration Profiles
Audit Classes and Their Audit Flags
Definitions of Audit Flags
Audit Flag Syntax
Prefixes That Modify Audit Flags
Audit Policies
Process Audit Characteristics
Audit Trail
Naming Conventions for Audit Files
Audit File Naming
How Audit File Names Are Used
Time-Stamp Format and Interpretation
Example of a File Name for a Still-Active File
Example of a Closed Audit File Name
Audit Record Structure
Audit Token Formats
acl Token
arbitrary Token
arg Token
attr Token
exec_args Token
exec_env Token
exit Token
file Token
group Token (Obsolete)
header Token
in_addr Token
ip Token (Obsolete)
ipc Token
ipc_perm Token
iport Token
newgroups Token
opaque Token
path Token
process Token
return Token
seq Token
socket Token
subject Token
text Token
trailer Token
Device Allocation Reference
Components of the Device-Allocation Mechanism
Using the Device Allocation Commands
The Allocate Error State
The device_maps File
The device_allocate File
Device-Clean Scripts
Object Reuse
Device-Clean Script for Tapes
Device-Clean Scripts for Diskettes and CD-ROM Devices
Device-Clean Script for Audio
Writing New Device-Clean Scripts
How the Device Allocation Mechanism Works
Appendix A System Administration Guide: Security Services Updates
Solaris 9 12/02 Updates
Solaris 9 8/03 Updates
Glossary
© 2010, Oracle Corporation and/or its affiliates