Setting a Service Policy

The -p option sets an authentication policy for a service. Each install service can have one set security policy. Select from the following choices:

require-client-auth

Confirms the identity of the client. Requires client and server authentication for all clients of the specified service. This option also requires encryption.

Requires all clients of the service to authenticate with client authentication. All clients of the specified service must be assigned credentials, and all SPARC clients of this service must have their firmware keys generated. Any clients of the service that are not configured for client authentication will not be able to use this install service.

require-server-auth

Confirms the identify of the AI server. Requires all clients of the specified service to perform server authentication. This option also requires encryption.

Requires at least AI server authentication for access to the specified install service. Client authentication is optional, but you must provide any assigned or attributed client credentials. You must also define firmware keys for all clients of this service.

optional

Allows both authenticated and unauthenticated clients to access the install service. The option also requires encryption if the AI server has credentials. This is the default behavior.

You must provide any assigned client credentials. Clients without assigned or attributed credentials do not use firmware keys or server authentication. Server authentication is provided only for clients configured for client authentication.

encr-only

For x86 clients only: Enables SSL/TLS end-to-end encryption without requiring authentication. Without authentication, the identities of the client and AI server are not guaranteed. Data in transit is not readable over the network by third parties.

disable

Disables all security for all clients of the specified service.

Clients of this service are not authenticated. No credentials are issued. Clients of this service cannot access the webserver_secure_files_dir directory described in Configuring the AI Server's Web Server Files Directory. Use this setting with caution: Any install service files that were previously protected by authentication are no longer protected. Client data is not secured from unwanted access. To re-enable authentication, specify the set-service subcommand again with a different security policy value.

The following additional examples show how you can set security for the install service.

Example 5-1 Requiring AI Server Authentication During Installation

This example specifies a security setting that requires server authentication to use an install service. Use the require-server-auth install service security setting to require clients of the specified service to at least authenticate the AI server.

$ installadm set-service -p require-server-auth -n install-service

Example 5-2 x86: Requiring Encryption During Installation

This example specifies a security setting that uses encryption but does not require authentication. On x86 clients, to protect data transfers for a specific install service but not require client or server authentication, use the encr-only security setting. You still need a server certificate. The data will be protected from snooping over the network, but the AI server will provide the data to any client that issues the proper request to the server.

$ installadm set-service -p encr-only -n install-service