How to Control Access to All Domain Consoles by Using Roles

1. Restrict access to a domain console by enabling console authorization checking.

   primary# svccfg -s vntsd setprop vntsd/authorization = true
   primary# svcadm refresh vntsd
   primary# svcadm restart vntsd

2. Create a role that has the solaris.vntsd.consoles authorization, which permits access to all domain consoles.

   primary# roleadd -A solaris.vntsd.consoles role-name
   primary# passwd role-name

3. Assign the new role to a user.

   primary# usermod -R role-name username

Example 2  Controlling Access to All Domain Consoles by Using Roles

First, enable console authorization checking to restrict access to a domain console.

primary# svccfg -s vntsd setprop vntsd/authorization = true
primary# svcadm refresh vntsd
primary# svcadm restart vntsd
primary# ldm ls
NAME             STATE      FLAGS   CONS    VCPU  MEMORY   UTIL  UPTIME
primary          active     -n-cv-  UART    8     16G      0.2%  47m
ldg1             active     -n--v-  5000    2     1G       0.1%  17h 50m
ldg2             active     -t----  5001    4     2G        25%  11s

The following example shows how to create the all_cons role with the solaris.vntsd.consoles authorization, which permits access to all domain consoles.

primary# roleadd -A solaris.vntsd.consoles all_cons
primary# passwd all_cons
New Password:
Re-enter new Password:
passwd: password successfully changed for all_cons

This command assigns the all_cons role to the sam user.

primary# usermod -R all_cons sam

User sam assumes the all_cons role and can access any console. For example:

$ id
uid=700299(sam) gid=1(other)
$ su all_cons
Password:
$ telnet localhost 5000
Trying 0.0.0.0...
Connected to 0.
Escape character is '^]'.

Connecting to console "ldg1" in group "ldg1" ....
Press ~? for control options ..

$ telnet localhost 5001
Trying 0.0.0.0...
Connected to 0.
Escape character is '^]'.

Connecting to console "ldg2" in group "ldg2" ....
Press ~? for control options ..

This example shows what happens when an unauthorized user, dana, attempts to access a domain console:

$ id
uid=702048(dana) gid=1(other)
$ telnet localhost 5000
Trying 0.0.0.0...
Connected to 0.
Escape character is '^]'.
Connection to 0 closed by foreign host.