Go to main content

Oracle® VM Server for SPARC 3.6 Administration Guide

Exit Print View

Updated: September 2019
 
 

How to Control Access to All Domain Consoles by Using Roles

  1. Restrict access to a domain console by enabling console authorization checking.
    primary# svccfg -s vntsd setprop vntsd/authorization = true
    primary# svcadm refresh vntsd
    primary# svcadm restart vntsd
  2. Create a role that has the solaris.vntsd.consoles authorization, which permits access to all domain consoles.
    primary# roleadd -A solaris.vntsd.consoles role-name
    primary# passwd role-name
  3. Assign the new role to a user.
    primary# usermod -R role-name username
Example 2  Controlling Access to All Domain Consoles by Using Roles

First, enable console authorization checking to restrict access to a domain console.

primary# svccfg -s vntsd setprop vntsd/authorization = true
primary# svcadm refresh vntsd
primary# svcadm restart vntsd
primary# ldm ls
NAME             STATE      FLAGS   CONS    VCPU  MEMORY   UTIL  UPTIME
primary          active     -n-cv-  UART    8     16G      0.2%  47m
ldg1             active     -n--v-  5000    2     1G       0.1%  17h 50m
ldg2             active     -t----  5001    4     2G        25%  11s

The following example shows how to create the all_cons role with the solaris.vntsd.consoles authorization, which permits access to all domain consoles.

primary# roleadd -A solaris.vntsd.consoles all_cons
primary# passwd all_cons
New Password:
Re-enter new Password:
passwd: password successfully changed for all_cons

This command assigns the all_cons role to the sam user.

primary# usermod -R all_cons sam

User sam assumes the all_cons role and can access any console. For example:

$ id
uid=700299(sam) gid=1(other)
$ su all_cons
Password:
$ telnet localhost 5000
Trying 0.0.0.0...
Connected to 0.
Escape character is '^]'.

Connecting to console "ldg1" in group "ldg1" ....
Press ~? for control options ..

$ telnet localhost 5001
Trying 0.0.0.0...
Connected to 0.
Escape character is '^]'.

Connecting to console "ldg2" in group "ldg2" ....
Press ~? for control options ..

This example shows what happens when an unauthorized user, dana, attempts to access a domain console:

$ id
uid=702048(dana) gid=1(other)
$ telnet localhost 5000
Trying 0.0.0.0...
Connected to 0.
Escape character is '^]'.
Connection to 0 closed by foreign host.