Skip Navigation Links | |
Exit Print View | |
![]() |
Trusted Extensions Configuration Guide Oracle Solaris 10 8/11 Information Library |
1. Security Planning for Trusted Extensions
2. Configuration Roadmap for Trusted Extensions
3. Adding Trusted Extensions Software to the Oracle Solaris OS (Tasks)
4. Configuring Trusted Extensions (Tasks)
5. Configuring LDAP for Trusted Extensions (Tasks)
Configuring an LDAP Server on a Trusted Extensions Host (Task Map)
Configuring an LDAP Proxy Server on a Trusted Extensions Host (Task Map)
Configuring the Sun Java System Directory Server on a Trusted Extensions System
Collect Information for the Directory Server for LDAP
Install the Sun Java System Directory Server
Create an LDAP Client for the Directory Server
Configure the Logs for the Sun Java System Directory Server
Configure a Multilevel Port for the Sun Java System Directory Server
Creating a Trusted Extensions Proxy for an Existing Sun Java System Directory Server
Configuring the Solaris Management Console for LDAP (Task Map)
Register LDAP Credentials With the Solaris Management Console
Enable the Solaris Management Console to Accept Network Communications
Edit the LDAP Toolbox in the Solaris Management Console
Verify That the Solaris Management Console Contains Trusted Extensions Information
6. Configuring a Headless System With Trusted Extensions (Tasks)
B. Using CDE Actions to Install Zones in Trusted Extensions
The LDAP naming service is the supported naming service for Trusted Extensions. If your site is not yet running the LDAP naming service, configure a Sun Java System Directory Server (Directory Server) on a system that is configured with Trusted Extensions.
If your site is already running a Directory Server, then you need to add the Trusted Extensions databases to the server. To access the Directory Server, you then set up an LDAP proxy on a Trusted Extensions system.
Note - If you do not use this LDAP server as an NFS server or as a server for Sun Ray clients, then you do not need to install any labeled zones on this server.
The items are listed in the order of their appearance in the Sun Java Enterprise System Install Wizard.
|
The Directory Server packages are available from the Sun Software Gateway web site.
Before You Begin
You are on a Trusted Extensions system with only a global zone installed. The system has no labeled zones.
Trusted Extensions LDAP servers are configured for clients that use pam_unix to authenticate to the LDAP repository. With pam_unix, the password operations, and therefore the password policy, are determined by the client. Specifically, the policy set by the LDAP server is not used. For the password parameters that you can set on the client, see Managing Password Information in System Administration Guide: Security Services. For information about pam_unix, see the pam.conf(4) man page.
Note - The use of pam_ldap on an LDAP client is not an evaluated configuration for Trusted Extensions.
The FQDN is the Fully Qualified Domain Name. This name is a combination of the host name and the administration domain, as in:
## /etc/hosts ... 192.168.5.5 myhost myhost.example-domain.com
On a system that is running a release prior to the Solaris 10 8/07 release, add IPv4 and IPv6 entries to the /etc/inet/ipnodes file. The entries for one system must be contiguous in the file.
If you are not running the latest release of the Oracle Solaris OS, you must have the following patches installed. The first number is a SPARC patch. The second number is an X86 patch.
138874–05, 138875–05: Native LDAP, PAM, name-service-switch patch
119313-35, 119314-36: WBEM patch
121308-21, 121308-21: Solaris Management Console patch
119315-20, 119316-20: Solaris Management Applications patch
Answer the questions by using the information from Collect Information for the Directory Server for LDAP. For a full list of questions, defaults, and suggested answers, see Chapter 11, Setting Up Sun Java System Directory Server With LDAP Clients (Tasks), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) and Chapter 12, Setting Up LDAP Clients (Tasks), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).
# $PATH /usr/sbin:.../opt/SUNWdsee/dsee6/bin:/opt/SUNWdsee/dscc6/bin:/opt/SUNWdsee/ds6/bin: /opt/SUNWdsee/dps6/bin
/opt/SUNWdsee/dsee6/man
# /usr/sbin/cacaoadm enable # /usr/sbin/cacaoadm start start: server (pid n) already running
Templates for the SMF services for the Directory Server are in the Sun Java System Directory Server packages.
# dsadm stop /export/home/ds/instances/your-instance # dsadm enable-service -T SMF /export/home/ds/instances/your-instance # dsadm start /export/home/ds/instances/your-instance
For information about the dsadm command, see the dsadm(1M) man page.
# dpadm stop /export/home/ds/instances/your-instance # dpadm enable-service -T SMF /export/home/ds/instances/your-instance # dpadm start /export/home/ds/instances/your-instance
For information about the dpadm command, see the dpadm(1M) man page.
# dsadm info /export/home/ds/instances/your-instance Instance Path: /export/home/ds/instances/your-instance Owner: root(root) Non-secure port: 389 Secure port: 636 Bit format: 32-bit State: Running Server PID: 298 DSCC url: - SMF application name: ds--export-home-ds-instances-your-instance Instance version: D-A00
Troubleshooting
For strategies to solve LDAP configuration problems, see Chapter 13, LDAP Troubleshooting (Reference), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).
You use this client to populate your Directory Server for LDAP. You must perform this task before you populate the Directory Server.
You can create the client temporarily on the Trusted Extensions Directory Server, then remove the client on the server, or you can create an independent client.
You can use the Trusted Extensions Directory Server, or install Trusted Extensions on a separate system.
Note - If you are not running the latest release of the Oracle Solaris OS, you must have the following patches installed. The first number is a SPARC patch. The second number is an X86 patch.
138874–05, 138875–05: Native LDAP, PAM, name-service-switch patch
119313-35, 119314-36: WBEM patch
121308-21, 121308-21: Solaris Management Console patch
119315-20, 119316-20: Solaris Management Applications patch
The entries in bold indicate the modifications. The file appears similar to the following:
# /etc/nsswitch.ldap # # An example file that could be copied over to /etc/nsswitch.conf; it # uses LDAP in conjunction with files. # # "hosts:" and "services:" in this file are used only if the # /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports. # LDAP service requires that svc:/network/ldap/client:default be enabled # and online. # the following two lines obviate the "+" entry in /etc/passwd and /etc/group. passwd: files ldap group: files ldap # consult /etc "files" only if ldap is down. hosts: files ldap dns [NOTFOUND=return] files # Note that IPv4 addresses are searched for in all of the ipnodes databases # before searching the hosts databases. ipnodes: files ldap [NOTFOUND=return] files networks: files ldap [NOTFOUND=return] files protocols: files ldap [NOTFOUND=return] files rpc: files ldap [NOTFOUND=return] files ethers: files ldap [NOTFOUND=return] files netmasks: files ldap [NOTFOUND=return] files bootparams: files ldap [NOTFOUND=return] files publickey: files ldap [NOTFOUND=return] files netgroup: ldap automount: files ldap aliases: files ldap # for efficient getservbyname() avoid ldap services: files ldap printers: user files ldap auth_attr: files ldap prof_attr: files ldap project: files ldap tnrhtp: files ldap tnrhdb: files ldap
This command copies the nsswitch.ldap file to the nsswitch.conf file.
In this example, the LDAP client is in the example-domain.com domain. The server's IP address is 192.168.5.5.
# ldapclient init -a domainName=example-domain.com -a profileNmae=default \ > -a proxyDN=cn=proxyagent,ou=profile,dc=example-domain,dc=com \ > -a proxyDN=cn=proxyPassword={NS1}ecc423aad0 192.168.5.5 System successfully configured
# ldapclient -v mod -a enableShadowUpdate=TRUE \ > -a adminDN=cn=admin,ou=profile,dc=example-domain,dc=com System successfully configured
For information about the enableShadowUpdate parameter, see enableShadowUpdate Switch in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) and the ldapclient(1M) man page.
This procedure configures three types of logs: access logs, audit logs, and error logs. The following default settings are not changed:
All logs are enabled and buffered.
Logs are placed in the appropriate /export/home/ds/instances/your-instance/logs/LOG_TYPE directory.
Events are logged at log level 256.
Logs are protected with 600 file permissions.
Access logs are rotated daily.
Error logs are rotated weekly.
The settings in this procedure meet the following requirements:
Audit logs are rotated daily.
Log files that are older than 3 months expire.
All log files use a maximum of 20,000 MBytes of disk space.
A maximum of 100 log files is kept, and each file is at most 500 MBytes.
The oldest logs are deleted if less than 500 MBytes free disk space is available.
Additional information is collected in the error logs.
The LOG_TYPE for access is ACCESS. The syntax for configuring logs is the following:
dsconf set-log-prop LOG_TYPE property:value
# dsconf set-log-prop ACCESS max-age:3M # dsconf set-log-prop ACCESS max-disk-space-size:20000M # dsconf set-log-prop ACCESS max-file-count:100 # dsconf set-log-prop ACCESS max-size:500M # dsconf set-log-prop ACCESS min-free-disk-space:500M
# dsconf set-log-prop AUDIT max-age:3M # dsconf set-log-prop AUDIT max-disk-space-size:20000M # dsconf set-log-prop AUDIT max-file-count:100 # dsconf set-log-prop AUDIT max-size:500M # dsconf set-log-prop AUDIT min-free-disk-space:500M # dsconf set-log-prop AUDIT rotation-interval:1d
By default, the rotation interval for audit logs is one week.
In this configuration, you specify additional data to be collected in the error log.
# dsconf set-log-prop ERROR max-age:3M # dsconf set-log-prop ERROR max-disk-space-size:20000M # dsconf set-log-prop ERROR max-file-count:30 # dsconf set-log-prop ERROR max-size:500M # dsconf set-log-prop ERROR min-free-disk-space:500M # dsconf set-log-prop ERROR verbose-enabled:on
You can also configure the following settings for each log:
# dsconf set-log-prop LOG_TYPE rotation-min-file-size:undefined # dsconf set-log-prop LOG_TYPE rotation-time:undefined
For information about the dsconf command, see the dsconf(1M) man page.
To work in Trusted Extensions, the server port of the Directory Server must be configured as a multilevel port (MLP) in the global zone.
# /usr/sbin/smc &
You are prompted for your password.
# tnctl -fz /etc/security/tsol/tnzonecfg
Several LDAP databases have been created or modified to hold Trusted Extensions data about label configuration, users, and remote systems. In this procedure, you populate the Directory Server databases with Trusted Extensions information.
Before You Begin
You must populate the database from an LDAP client where shadow updating is enabled. For the prerequisites, see Create an LDAP Client for the Directory Server.
If site security requires separation of duty, complete the following before populating the Directory server:
# mkdir -p /setup/files
# cd /etc # cp aliases group networks netmasks protocols /setup/files # cp rpc services auto_master /setup/files # cd /etc/security # cp auth_attr prof_attr exec_attr /setup/files/ # # cd /etc/security/tsol # cp tnrhdb tnrhtp /setup/files
If you are running the Solaris 10 11/06 release without patches, copy the ipnodes file.
# cd /etc/inet # cp ipnodes /setup/files
In the following list of automaps, the first of each pair of lines shows the name of the file. The second line of each pair shows the file contents. The zone names identify labels from the default label_encodings file that is included with the Trusted Extensions software.
Substitute your zone names for the zone names in these lines.
myNFSserver identifies the NFS server for the home directories.
/setup/files/auto_home_public * myNFSserver_FQDN:/zone/public/root/export/home/& /setup/files/auto_home_internal * myNFSserver_FQDN:/zone/internal/root/export/home/& /setup/files/auto_home_needtoknow * myNFSserver_FQDN:/zone/needtoknow/root/export/home/& /setup/files/auto_home_restricted * myNFSserver_FQDN:/zone/restricted/root/export/home/&
No wildcard mechanism can be used here. The IP address of every system to be contacted, including the IP addresses of labeled zones, must be in this file.
Labeled systems are of type cipso. Also, the name of the security template for labeled systems is cipso. Therefore, in the default configuration, a cipso entry is similar to the following:
192.168.25.2:cipso
Note - This list includes the IP addresses of global zones and labeled zones.
Unlabeled systems are of type unlabeled. The name of the security template for unlabeled systems is admin_low. Therefore, in the default configuration, an entry for an unlabeled system is similar to the following:
192.168.35.2:admin_low
# tnchkdb -h /setup/files/tnrhdb
For example, the following command populates the server from the hosts file in the staging area.
# /usr/sbin/ldapaddent -D "cn=directory manager" \ -w dirmgr123 -a simple -f /setup/files/hosts hosts
In the global zone, run the ldapclient uninit command. Use verbose output to verify that the system is no longer an LDAP client.
# ldapclient -v uninit
For more information, see the ldapclient(1M) man page.