Skip Navigation Links | |
Exit Print View | |
Trusted Extensions Configuration Guide Oracle Solaris 10 8/11 Information Library |
1. Security Planning for Trusted Extensions
2. Configuration Roadmap for Trusted Extensions
3. Adding Trusted Extensions Software to the Oracle Solaris OS (Tasks)
Initial Setup Team Responsibilities
Installing or Upgrading the Oracle Solaris Operating System for Trusted Extensions
Install an Oracle Solaris System to Support Trusted Extensions
Prepare an Installed Oracle Solaris System for Trusted Extensions
Collecting Information and Making Decisions Before Enabling Trusted Extensions
Collect System Information Before Enabling Trusted Extensions
Make System and Security Decisions Before Enabling Trusted Extensions
Enabling the Trusted Extensions Service
4. Configuring Trusted Extensions (Tasks)
5. Configuring LDAP for Trusted Extensions (Tasks)
6. Configuring a Headless System With Trusted Extensions (Tasks)
B. Using CDE Actions to Install Zones in Trusted Extensions
For each system on which Trusted Extensions is going to be configured, you need to know some information, and make some decisions about configuration. For example, because you are going to create labeled zones, you might want to set aside disk space where the zones can be cloned as a ZFS file system. ZFS provides additional isolation for the zones.
The hostname is the name of the host on the network, and is the global zone. On an Oracle Solaris system, the getent command returns the hostname, as in:
# getent hosts machine1 192.168.0.11 machine1
A system with two IP addresses can function as a multilevel server. A system with one IP address must have access to a multilevel server in order to print or perform multilevel tasks. For a discussion of IP address options, see Planning for Multilevel Access.
Most systems require a second IP address for the labeled zones. For example, the following is a host with a second IP address for labeled zones:
# getent hosts machine1-zones 192.168.0.12 machine1-zones
For the LDAP server that is running Trusted Extensions software, you need the following information:
The name of the Trusted Extensions domain that the LDAP server serves
The IP address of the LDAP server
The LDAP profile name that will be loaded
For an LDAP proxy server, you also need the password for the LDAP proxy.
For each system on which Trusted Extensions is going to be configured, make these configuration decisions before enabling the software.
At a secure site, this step has been done for every installed Oracle Solaris system.
For SPARC systems, a PROM security level and password has been provided.
For x86 systems, the BIOS is protected.
On all systems, root is protected with a password.
If you have a site-specific label_encodings file, the file must be checked and installed before other configuration tasks can be started. If your site does not have a label_encodings file, you can use the default file that Sun supplies. Sun also supplies other label_encodings files, which you can find in the /etc/security/tsol directory. The Sun files are demonstration files. They might not be suitable for production systems.
To customize a file for your site, see Trusted Extensions Label Administration.
The following table lists the label names and suggested zone names for the default label_encodings file.
|
For ease of NFS mounting, the zone name of a particular label must be identical on every system. Some systems, such as multilevel print servers, do not need to have labeled zones installed. However, if you do install labeled zones on a print server, the zone names must be identical to the zone names of other systems on your network.
Your site's security policy can require you to administer Trusted Extensions by assuming a role. If so, or if you are configuring the system to satisfy criteria for an evaluated configuration, you must create roles early in the configuration process.
If you are not required to configure the system by using roles, you can choose to configure the system as superuser. This method of configuration is less secure. Audit records do not indicate which user was superuser during configuration. Superuser can perform all tasks on the system, while a role can perform a more limited set of tasks. Therefore, configuration is more controlled when being performed by roles.
You can create zones from scratch, copy zones, or clone zones. These methods differ in speed of creation, disk space requirements, and robustness. For the trade-offs, see Planning Your Labeled Zones in Trusted Extensions.
Using local files for administration is practical for non-networked systems.
LDAP is the naming service for a networked environment. A populated LDAP server is required when you configure several machines.
If you have an existing Sun Java System Directory Server (LDAP server), you can create an LDAP proxy server on a system that is running Trusted Extensions. The multilevel proxy server handles communications with the unlabeled LDAP server.
If you do not have an LDAP server, you can configure a system that runs Trusted Extensions software as a multilevel LDAP server.
For example, you might want to consider the following security issues:
Determine which devices can be attached to the system and allocated for use.
Identify which printers at what labels are accessible from the system.
Identify any systems that have a limited label range, such as a gateway system or a public kiosk.
Identify which labeled systems can communicate with particular unlabeled systems.