Skip Navigation Links | |
Exit Print View | |
![]() |
Trusted Extensions Configuration Guide Oracle Solaris 10 8/11 Information Library |
1. Security Planning for Trusted Extensions
2. Configuration Roadmap for Trusted Extensions
3. Adding Trusted Extensions Software to the Oracle Solaris OS (Tasks)
4. Configuring Trusted Extensions (Tasks)
Setting Up the Global Zone in Trusted Extensions
Check and Install Your Label Encodings File
Enable IPv6 Networking in Trusted Extensions
Configure the Domain of Interpretation
Create ZFS Pool for Cloning Zones
Reboot and Log In to Trusted Extensions
Initialize the Solaris Management Console Server in Trusted Extensions
Make the Global Zone an LDAP Client in Trusted Extensions
Configure the Network Interfaces in Trusted Extensions
Copy or Clone a Zone in Trusted Extensions
Adding Network Interfaces and Routing to Labeled Zones
Add a Network Interface to Route an Existing Labeled Zone
Add a Network Interface That Does Not Use the Global Zone to Route an Existing Labeled Zone
Creating Roles and Users in Trusted Extensions
Create Rights Profiles That Enforce Separation of Duty
Create the Security Administrator Role in Trusted Extensions
Create a Restricted System Administrator Role
Create Users Who Can Assume Roles in Trusted Extensions
Verify That the Trusted Extensions Roles Work
Enable Users to Log In to a Labeled Zone
Creating Home Directories in Trusted Extensions
Create the Home Directory Server in Trusted Extensions
Enable Users to Access Their Home Directories in Trusted Extensions
Adding Users and Hosts to an Existing Trusted Network
Add an NIS User to the LDAP Server
Troubleshooting Your Trusted Extensions Configuration
netservices limited Was Run After Trusted Extensions Was Enabled
Cannot Open the Console Window in a Labeled Zone
Labeled Zone Is Unable to Access the X Server
Additional Trusted Extensions Configuration Tasks
How to Copy Files to Portable Media in Trusted Extensions
How to Copy Files From Portable Media in Trusted Extensions
How to Remove Trusted Extensions From the System
5. Configuring LDAP for Trusted Extensions (Tasks)
6. Configuring a Headless System With Trusted Extensions (Tasks)
B. Using CDE Actions to Install Zones in Trusted Extensions
The following tasks support environments where each zone is connected to a separate physical network.
|
This procedure adds zone-specific network interfaces to existing labeled zones. This configuration supports environments where each labeled zone is connected to a separate physical network. The labeled zones use the network routing that the global zone provides.
Note - The global zone must configure an IP address for every subnet in which a non-global zone address is configured.
Before You Begin
You are superuser in the global zone.
For every zone, you have completed the tasks in Creating Labeled Zones.
Use a standard naming convention, such as adding -zone-name to the name of the host.
## /etc/hosts in global zone 10.10.8.2 hostname-zone-name1 10.10.8.3 hostname-global-name1 10.10.9.2 hostname-zone-name2 10.10.9.3 hostname-global-name2
## /etc/netmasks in global zone 10.10.8.0 255.255.255.0 10.10.9.0 255.255.255.0
For more information, see the netmasks(4) man page.
# ifconfig -a
# ifconfig interface-nameN1 plumb # ifconfig interface-nameN1 10.10.8.3 up # ifconfig interface-nameN2 plumb # ifconfig interface-nameN2 10.10.9.3 up
# /etc/hostname.interface-nameN1 10.10.8.3 # /etc/hostname.interface-nameN2 10.10.9.3
The global zone addresses are configured immediately upon system startup. The zone-specific addresses are configured when the zone is booted.
If the gateway to the network is not configured with labels, assign the admin_low security template. If the gateway to the network is labeled, assign a cipso security template.
You can create security templates of host type cipso that reflect the label of every network. For the procedures to create and assign the templates, see Configuring Trusted Network Databases (Task Map) in Trusted Extensions Administrator’s Procedures.
# zoneadm -z zone-name halt
# /usr/sbin/txzonemgr
# ifconfig -a
# netstat -rn
Troubleshooting
To debug zone configuration, see the following:
This procedure sets zone-specific default routes for existing labeled zones. In this configuration, the labeled zones do not use the global zone for routing.
The labeled zone must be plumbed in the global zone before the zone is booted. However, to isolate the labeled zone from the global zone, the interface must be in the down state when the zone is booted. For more information, see Chapter 17, Non-Global Zone Configuration (Overview), in System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones.
Note - A unique default route must be configured for every non-global zone that is booted.
Before You Begin
You are superuser in the global zone.
For every zone, you have completed the tasks in Creating Labeled Zones. You are using either the vni0 interface or the lo0 interface to connect the labeled zones to the global zone.
Use the ifconfig -a command to determine the IP address and netmask. Use the zonecfg -z zonename info net command to determine if a default router has been assigned.
# touch /etc/hostname.interface # touch /etc/hostname.interface:n
For more information, see the netmasks(4) man page.
# ifconfig zone1-network-interface plumb # ifconfig zone2-network-interface plumb
# ifconfig -a zone1-network-interface zone1-IP-address down zone2-network-interface zone2-IP-address down
The zone-specific addresses are configured when the zone is booted.
## /etc/netmasks in global zone 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
For more information, see the netmasks(4) man page.
Create security templates of host type cipso that reflect the label of every network. To create and assign the templates, see Configuring Trusted Network Databases (Task Map) in Trusted Extensions Administrator’s Procedures.
In the Labeled Zone Manager, you will add the network interfaces for the labeled zones. In the terminal window, you will display information about the zone and set the default router.
# zoneadm -z zone-name halt
# zonecfg -z zone-name info net net: address: IP-address physical: zone-network-interface defrouter not specified
# zonecfg -z zone-name zonecfg:zone-name > select net address=IP-address zonecfg:zone-name:net> set defrouter=router-address zonecfg:zone-name:net> end zonecfg:zone-name > verify zonecfg:zone-name > commit zonecfg:zone-name > exit #
For more information, see the zonecfg(1M) man page and How to Configure the Zone in System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones.
# zoneadm -z zone-name boot
# netstat -rn
A routing table is displayed. The destination and interface for the labeled zone is different from the entry for the global zone.
# zonecfg -z zone-name zonecfg:zone-name > select net address=zone-IP-address zonecfg:zone-name:net> remove net defrouter=zone-default-route zonecfg:zone-name:net> info net net: address: zone-IP-address physical: zone-network-interface defrouter not specified
Example 4-5 Setting a Default Route for a Labeled Zone
In this example, the administrator routes the Secret zone to a separate physical subnet. Traffic to and from the Secret zone is not routed through the global zone. The administrator uses the Labeled Zone Manager and the zonecfg command, then verifies that routing works.
The administrator determines that qfe1 and qfe1:0 are not currently in use. and creates a mapping for two labeled zones. qfe1 is the designated interface for the Secret zone.
Interface IP Address Netmask Default Router qfe1 192.168.2.22 255.255.255.0 192.168.2.2 qfe1:0 192.168.3.33 255.255.255.0 192.168.3.3
First, the administrator creates the /etc/hostname.qfe1 file and configures the /etc/netmasks file.
# touch /etc/hostname.qfe1
# cat /etc/netmasks ## /etc/netmasks in global zone 192.168.2.0 255.255.255.0
Then, the administrator plumbs the network interface and verifies that the interface is down.
# ifconfig qfe1 plumb # ifconfig -a
Then, in the Solaris Management Console, the administrator creates a security template with a single label, Secret, and assigns the IP address of the interface to the template.
The administrator halts the zone.
# zoneadm -z secret halt
The administrator runs the txzonemgr script to open the Labeled Zone Manager.
# /usr/sbin/txzonemgr
In the Labeled Zone Manager, the administrator selects the Secret zone, selects Add Network, and then selects a network interface. The administrator closes the Labeled Zone Manager.
On the command line, the administrator selects the zone's IP address, then sets its default route. Before exiting the command, the administrator verifies the route and commits it.
# zonecfg -z secret zonecfg: secret > select net address=192.168.6.22 zonecfg: secret:net> set defrouter=192.168.6.2 zonecfg: secret:net> end zonecfg: secret > verify zonecfg: secret > commit zonecfg: secret > info net net: address: 192.168.6.22 physical: qfe1 defrouter: 192.168.6.2 zonecfg: secret > exit #
The administrator boots the zone.
# zoneadm -z secret boot
In a separate terminal window in the global zone, the administrator verifies the sending and receiving of packets.
# netstat -rn Routing Table: IPv4 Destination Gateway Flags Ref Use Interface -------------------- -------------------- ----- ----- ------- --------- default 192.168.5.15 UG 1 2664 qfe0 192.168.6.2 192.168.6.22 UG 1 240 qfe1 192.168.3.3 192.168.3.33 U 1 183 qfe1:0 127.0.0.1 127.0.0.1 UH 1 380 lo0 ...
This procedure enables you to separately configure a name service daemon (nscd) in each labeled zone. This configuration supports environments where each zone is connected to a subnetwork that runs at the label of the zone, and the subnetwork has its own name server for that label.
Note - This configuration does not satisfy the criteria for an evaluated configuration. In an evaluated configuration, the nscd daemon runs only in the global zone. Doors in each labeled zone connect the zone to the global nscd daemon.
Before You Begin
You are superuser in the global zone. root must not yet be a role. You have successfully completed Add a Network Interface to Route an Existing Labeled Zone.
This configuration requires that you have advanced networking skills. If LDAP is your naming service, you are responsible for establishing the LDAP client connection to each labeled zone. The nscd daemon caches the name service information, but does not route it.
In a terminal window in every labeled zone, run the following command:
zone-name # netstat -rn
# /usr/sbin/txzonemgr
This option is intended to be used once, during initial system configuration.
For assistance, see the nscd(1M) and nscd.conf(4) man pages.
zone-name # svcs -x name-service-cache svc:/system/name-service-cache:default (name service cache) State: online since October 10, 2010 10:10:10 AM PDT See: nscd(1M) See: /etc/svc/volatile/system-name-service-cache:default.log Impact: None.
zone-name # netstat -rn
This selection removes the nscd daemon in every labeled zone.