How to Enforce a New Local User Password in a Labeled Zone

Under the following conditions, labeled zones must be rebooted:

• One or more local users have changed their passwords.

• All zones are using a single instance of the naming service cache daemon (nscd).

• The system is administered with files, not LDAP.

Before You Begin

You must be assigned the Zone Security rights profile.

• To enforce the password change, reboot the labeled zones that the users can access.

  Use one of the following methods:

  • Use the txzonemgr GUI.

    # txzonemgr &

    In the Labeled Zone Manager, navigate to the labeled zone and from the list of commands, select Halt, then select Boot.

  • In a terminal window in the global zone, use zone administration commands.

    You can choose to shut down or halt the system.

    • The zlogin command cleanly shuts down the zone.

      # zlogin labeled-zone shutdown -i 0
      # zoneadm -z labeled-zone boot

    • The halt subcommand bypasses the shutdown scripts.

      # zoneadm -z labeled-zone halt
      # zoneadm -z labeled-zone boot

Troubleshooting

To automatically update user passwords for labeled zones, you must either configure LDAP or configure one naming service per zone. You can also configure both.

• To configure LDAP, see Chapter 5, Configuring LDAP for Trusted Extensions.

• Configuring one naming service per zone requires advanced networking skills. For the procedure, see How to Configure a Separate Name Service for Each Labeled Zone.