Skip Navigation Links | |
Exit Print View | |
Oracle Solaris Trusted Extensions Configuration and Administration Oracle Solaris 11 Express 11/10 |
Part I Initial Configuration of Trusted Extensions
1. Security Planning for Trusted Extensions
2. Configuration Roadmap for Trusted Extensions
3. Adding Trusted Extensions Software to the Oracle Solaris OS (Tasks)
4. Configuring Trusted Extensions (Tasks)
5. Configuring LDAP for Trusted Extensions (Tasks)
6. Configuring a Headless System With Trusted Extensions (Tasks)
Part II Administration of Trusted Extensions
7. Trusted Extensions Administration Concepts
8. Trusted Extensions Administration Tools
9. Getting Started as a Trusted Extensions Administrator (Tasks)
10. Security Requirements on a Trusted Extensions System (Overview)
11. Administering Security Requirements in Trusted Extensions (Tasks)
12. Users, Rights, and Roles in Trusted Extensions (Overview)
13. Managing Users, Rights, and Roles in Trusted Extensions (Tasks)
14. Remote Administration in Trusted Extensions (Tasks)
15. Trusted Extensions and LDAP (Overview)
16. Managing Zones in Trusted Extensions (Tasks)
17. Managing and Mounting Files in Trusted Extensions (Tasks)
18. Trusted Networking (Overview)
19. Managing Networks in Trusted Extensions (Tasks)
20. Multilevel Mail in Trusted Extensions (Overview)
21. Managing Labeled Printing (Tasks)
Labels, Printers, and Printing
Restricting Access to Printers and Print Job Information in Trusted Extensions
Labeled Banner and Trailer Pages
PostScript Printing of Security Information
Interoperability of Trusted Extensions With Trusted Solaris 8 Printing
Trusted Extensions Print Interfaces (Reference)
Managing Printing in Trusted Extensions (Task Map)
Configuring Labeled Printing (Task Map)
How to Configure a Multilevel Print Server and Its Printers
How to Configure a Zone for Single-Label Printing
How to Enable a Trusted Extensions Client to Access a Printer
How to Configure a Restricted Label Range for a Printer
Reducing Printing Restrictions in Trusted Extensions (Task Map)
How to Remove Labels From Printed Output
How to Assign a Label to an Unlabeled Print Server
How to Remove Page Labels From All Print Jobs
How to Enable Specific Users to Suppress Page Labels
How to Suppress Banner and Trailer Pages for Specific Users
How to Enable Users to Print PostScript Files in Trusted Extensions
22. Devices in Trusted Extensions (Overview)
23. Managing Devices for Trusted Extensions (Tasks)
24. Trusted Extensions Auditing (Overview)
25. Software Management in Trusted Extensions (Reference)
Creating and Managing a Security Policy
Site Security Policy and Trusted Extensions
Computer Security Recommendations
Physical Security Recommendations
Personnel Security Recommendations
Additional Security References
B. Configuration Checklist for Trusted Extensions
Checklist for Configuring Trusted Extensions
C. Quick Reference to Trusted Extensions Administration
Administrative Interfaces in Trusted Extensions
Oracle Solaris Interfaces Extended by Trusted Extensions
Tighter Security Defaults in Trusted Extensions
Limited Options in Trusted Extensions
D. List of Trusted Extensions Man Pages
Trusted Extensions Man Pages in Alphabetical Order
Oracle Solaris Man Pages That Are Modified by Trusted Extensions
The following tasks are optional. They reduce the printing security that Trusted Extensions provides by default when the software is installed.
|
Printers that do not have a Trusted Extensions printer model script do not print labeled banner or trailer pages. The body pages also do not include labels.
You must be in the Security Administrator role in the global zone.
% lpadmin -p printer -o nobanner=never
Body pages are still labeled.
% lpadmin -p printer \ -m { standard | netstandard | standard_foomatic | netstandard_foomatic }
No labels appear on printed output.
An Oracle Solaris print server is an unlabeled print server that can be assigned a label for Trusted Extensions access to the printer at that label. Printers that are connected to an unlabeled print server can print jobs only at the label that has been assigned to the print server. Jobs print without labels or trailer pages and might print without banner pages. If a job prints with a banner page, the page does not contain any security information.
A Trusted Extensions system can be configured to submit jobs to a printer that is managed by an unlabeled print server. Users can print jobs on the unlabeled printer at the label that the security administrator assigns to the print server.
You must be in the Security Administrator role in the global zone.
For details, see How to Assign a Security Template to a Host or a Group of Hosts.
Choose a label. Users who are working at that label can send print jobs to the Oracle Solaris printer at the label of the print server. Pages do not print with labels, and banner and trailer pages are also not part of the print job.
Example 21-1 Sending Public Print Jobs to an Unlabeled Printer
Files that are available to the general public are suitable for printing to an unlabeled printer. In this example, marketing writers need to produce documents that do not have labels printed on the top and bottom of the pages.
The security administrator assigns an unlabeled host type template to the Oracle Solaris print server. The template is described in Example 19-6. The arbitrary label of the template is PUBLIC. The printer pr-nolabel1 is connected to this print server. Print jobs from users in a PUBLIC zone print on the pr-nolabel1 printer with no labels. Depending on the settings for the printer, the jobs might or might not have banner pages. The banner pages do not contain security information.
This procedure prevents all print jobs on a Trusted Extensions printer from including visible labels on the body pages of the print job.
You must be in the Security Administrator role in the global zone.
Find the following lines:
%% To eliminate page labels completely, change this line to %% set the page label to an empty string: /PageLabel () def /PageLabel Job_PageLabel def
Note - The value Job_PageLabel might be different at your site.
/PageLabel () def
This procedure enables an authorized user or role to print jobs on a Trusted Extensions printer without labels on the top and bottom of each body page. Page labels are suppressed for all labels at which the user can work.
You must be in the Security Administrator role in the global zone.
Assign a rights profile that includes the Print without Label authorization to those users and roles. For details, see How to Create a Rights Profile for Convenient Authorizations.
% lp -o nolabels staff.mtg.notes
You must be in the Security Administrator role in the global zone.
Assign the profile to each user or role that is allowed to print without banner and trailer pages.
For details, see How to Create a Rights Profile for Convenient Authorizations.
% lp -o nobanner staff.mtg.notes
You must be in the Security Administrator role in the global zone.
PRINT_POSTSCRIPT=1
AUTHS_GRANTED=other-authorizations,solaris.print.ps
Assign a profile that includes the solaris.print.ps authorization to those users and roles. For details, see How to Create a Rights Profile for Convenient Authorizations.
Example 21-2 Enabling PostScript Printing From a Public System
In the following example, the security administrator has constrained a public kiosk to operate at the PUBLIC label. The system also has a few icons that open topics of interest. These topics can be printed.
The security administrator creates an /etc/default/print file on the system. The file has one entry to enable the printing of PostScript files. No user needs a Print Postscript authorization.
# vi /etc/default/print # PRINT_POSTSCRIPT=0 PRINT_POSTSCRIPT=1