Index

Numerics

2FA 1

A

access
- default 1.2.1
- limited and monitored 1.2.1
- remote 1.7.2
- to system files 1.2.2
account-policy SMF stencil 1.1.5
accounts
- default 1.2.1
- initial 1.2.1
- roles 1.5
adiheap security extension 1.1.3
adistack security extension 1.1.3
admhist command 1.1.8
ADMIN_LOW label
- protecting administrative files A.8.5
administering 1
AES128 Secure Shell algorithm 1.2.1
algorithms
- AES128 1.2.1
- SHA256 1.2.1
- storage 1.4.2
analytics
- uses auditing data 1.1.8
annotation
- audit records with 1.1.8
annotation user attribute 1.1.5
applications
- authorizations and 1.6.4
- developed securely 1.9
- isolating in zones 1.6
- JCE and 1.6.5
- protecting
  - JCE 1.6.5
  - legacy 2.8
  - overview 1.6
  - SMF and 2.8
  - with authorizations 1.6.4
  - with TCP wrappers 1.7, 1.7.1.2
  - zones 1.6.2
- zones and 1.6.2
ARMOR roles 1.5
ASLR (address space layout randomization) 1.6
assessments
- metadata 1.1.1
- stored centrally 1.1.1
audit classes
- displaying configured 1.1.8
- pe audit class 1.1.8
- per-plugin configuration 1.1.8
- sstore 1.1.8
auditconfig command
- ‐lsclass option 1.1.8
- ‐lsevent option 1.1.8
- ‐p_flags option 1.1.8
audit events
- listing per audit class 1.1.8
- logging 1.1.8
auditing 1
auditreduce command
- ‐t option 1.1.8
audit service
- annotation 1.1.8
- audit_tags database 1.1.8
- default configuration 1.2.1
- managing 3.2
- new security features 1.1.8
- per-object auditing 1.1.8
audit tags 1.1.8
authentication
- annotated 1.1.8
- IPsec and 1.7.2.1
- Kerberos and 1.7.2.3
- multifactor (MFA) 1.5.1
- new security features 1.1.6
- PAM and user 1.5.2
- pluggable 1.5.2
- remote access and 1.7.2
- SASL 1.1.6
authorizations 1

B

BART
- verifying file integrity 3.2
Basic Solaris User rights profile 1.2.1
boot environment
- firmware requirements 1.1.3
- verifying secure 3.1

C

capabilities 1
certifications
- Common Criteria 1.8.2
chmod command
- new options 1.1.3
chmod S+vnounlink command 2.6
Common Vulnerabilities and Exposures (CVE)
- monitoring 3
compliance
- assessment 3.2
- common store 1.1.1
- new security features 1.1.1
computer access
- administrator responsibilities A.8.4
configuring
- installation 2.1
- security 2
- system initially 2.2
- Trusted Extensions 2.9
Console User rights profile 1.2.1
core files
- protecting 2.7
critical patch updates (CPU)
- monitoring 3
Cryptographic Framework
- central repository 1.4.2
- FIPS 140-2 and 1.4.2
- IPsec and IKE and 1.7.2.1
- new security features 1.1.2
cryptography 1
- new security features 1.1.2

D

daemons
- protected with privileges 1.2.2
- rsyslog 1.1.3, 3.2
data, protecting 1.4, 2.6
database logs
- preventing deletion 2.6
datalinks
- protecting on ports 1.1.7
data loss prevention
- labeling 1.1.4, 1.8.1
- Trusted Extensions 1.8.2
decisions to make
- based on site security policy A.2
default password length 1.1.6
defaults
- access 1.2.1
- accounts 1.2.1
- audit service 1.2.1
- desktop 1.2.2
- kernel protections 1.2.2
- network access 1.2.1
- password algorithm 1.2.1
- password length 1.1.6
- system 1.2.1
- system file access 1.2.2
- ZFS file system 1.2.2
desktop
- defaults 1.2.2
- solaris-desktop package 2.1
displaying
- audit events for specified audit flags 1.1.8
DoS attacks
- preventing, file system 2.5
- preventing, network 2.4

E

encrypted ZFS boot
- new security features 1.1.4
encrypting 1
- file systems 2.5
- heterogeneous network communications 1.7.2.3
- network access 1.7.2.2
- network connections 2.4
- remote access and 1.7.2
executable stack corruption
- preventing 2.7

F

features 1
file integrity checks
- monitoring 3
files
- database logs 2.6
- default system file access 1.2.2
- log files 3.2
- new security features 1.1.4
- Oracle database logs 2.6
- package verification 3.1
- permissions 1.4.1
  - defaults 1.2.2
  - protecting and modifying 2.6
- preventing accidental deletion 2.6
- verifying integrity 3.2
file systems
- labeled 1.8.2
- new security features 1.1.4
- protecting 2.5
- ZFS default 1.4.4
filtering audit records 1.1.8
FIPS 140-2
- Cryptographic Framework providing 1.4.2
- IPsec and IKE consuming 1.7.2.1
- Kerberos consuming 1.7.2.3
- Secure Shell consuming 1.7.2.2
firewall
- configuring 2.4
- Packet Filter 1.7.1.1
firmware
- requirements for verified boot 1.1.3
fragmented messages
- handled in IKEv2 1.1.7

G

group packages
- Oracle Solaris 2.1
groups
- deletion precautions A.8.6
- security requirements A.8.6
guidelines
- computer security A.3
- creating security policy A.1
- email security A.8.2
- equipment retirement A.6
- for developers 1.9
- group administration A.8.6
- information protection A.8.4
- password enforcement A.8.3
- password protection A.8.5
- personnel security A.5
- physical security A.4
- security decisions A.2
- security enforcement A.8
- site security A
- user deletion A.8.7
- violations to be aware of A.7

H

hardening
- solaris-minimal-server package 2.1
hardware
- Oracle Hardware Management Package 1.2.3
- scrubbing A.6
- SPARC T series servers 3.1
heap corruption
- preventing 2.7

I

identity service 1.4.3
IgnoreUnknown Secure Shell keyword 1.1.6
IKE 1
IKEv2
- handling fragmented messages 1.1.7
immutable zones 1.6.2, 2.7
inetd services
- protecting with TCP wrappers 1.7.1.2
information protection
- guidelines A.8.4
installing
- group packages 2.1
- Kerberos using AI 1.7.2.3
- Oracle Solaris 2.1
- Trusted Extensions 2.9
IP packets
- handling fragmentation 1.1.7
- protecting with IPsec 1.7.2.1
IPsec and IKE
- configuring 2.4
- Cryptographic Framework and 1.7.2.1
- FIPS 140-2 and 1.7.2.1
- protecting packets 1.7.2.1
IPS packages 1
isolating
- applications in zones 1.6

J

Java Cryptography Extension (JCE) 1.6.5

K

Kerberos
- FIPS 140-2 and 1.7.2.3
- remote access protection 1.7.2.3
kernel
- defaults 1.2.2
- new security features 1.1.3
- protected by privileges 1.2.2
kernel zones 1.6.2
Key Management Framework (KMF) 1.4.2

L

labeled environment
- isolating processes 2.7
labeled file systems
- new security features 1.1.4
labeled security
- Oracle Solaris and Trusted Extensions 1.8
- Trusted Extensions and 2.9
labeling
- data loss prevention implementation 1.1.4, 1.8.1
- for MAC 1.8
- for privacy 1.1.4, 1.8
label security
- file systems and 1.8.2
- network communications and 1.8.2
- Trusted Extensions and 1.8.2
legacy applications
- protecting 2.8
legacy services
- protecting with least privilege 2.7
limiting 1
log files and system security 3.2
logging
- audit events 1.1.8

M

maintaining
- file integrity with BART 3.2
- system security 3.1
malware
- isolating applications from 1.6
- protecting kernel from 1.6.3
managing
- audit service 3.2
- Cryptographic Framework 1.4.2
- passwords 1.5.1, A.8.3
- public key objects 1.4.2
MAXDAYS password variable 1.1.6
metadata 1
MINDAYS password variable 1.1.6
modifying 1
monitoring
- system activity and compliance 3
- system security 3.2
multilevel security
- configuring 2.9

N

network access
- default 1.2.1
network communications
- defense in depth 1.7.2
- Kerberos and 1.7.2.3
- labeled security and 1.8.2, 2.9
- protecting 2.4
new security features
- auditing 1.1.8
- authentication 1.1.6
- compliance 1.1.1
- cryptography 1.1.2
- files 1.1.4
- file systems 1.1.4
- kernel 1.1.3
- labeled files and processes 1.1.4
- networking 1.1.7
- RBAC 1.1.5
nounlink ZFS attribute
- preventing file deletion 2.6
nxheap security extension 1.6
nxstack security extension 1.6

O

OpenBSD Packet Filter 1
OpenSSH 1
- interoperability with SunSSH 1.1.6
- version 1.1.6
Oracle database logs
- preventing deletion 2.6
Oracle Hardware Management Package 1.2.3
Oracle Solaris group packages 2.1

P

package integrity checks
- monitoring 3
packages
- automated installation 2.1
- groups 2.1
- repository maintenance 3.1
- signed 3.1
- solaris-desktop 2.1
- solaris-large-server 2.1
- solaris-minimal-server 2.1
- solaris-small-server 2.1
- trusted 2.9
- verifying 3.1
packet filter
- OpenBSD Packet Firewall 1.7.1
PAM (Pluggable Authentication Modules)
- user authentication framework 1.5.2
PASSLENGTH password variable 1.1.6
passwords
- change 1.5.1
- constraint variables 1.1.6
- default hash algorithm 1.2.1
- default length 1.1.6
- new security features 1.1.6
- PAM and 1.5.2
- policy 1.5.1
- requirements 1.2.1
- security features 1.2.1
- SHA256 hash algorithm 1.2.1
- storage A.8.5
pe audit class 1.1.8
permissions
- files 1.2.2, 1.4.1
per-object auditing 1.1.8
PKCS #11 cryptographic library 1.4.2
pluggable authentication modules 1
policy
- label-based MAC policies 1.8.2
- passwords 1.5.1
- site security 1.10
ports
- protecting datalinks 1.1.7
powers 1
predefined roles 1.5
preventing
- accidental file deletion 2.6
- DoS attacks 2.4, 2.5
- executable stack corruption 2.7
- filling file systems 2.5
- heap corruption 2.7
privacy through labeling 1.1.4
privileged execution audit class 1.1.8
privileges
- daemons and 1.2.2
- Oracle Solaris and 1.2.1, 1.6.1
- protecting kernel processes 1.2.2
process rights 1
profiles 1
programs 1
protecting
- applications
  - JCE 1.6.5
  - with authorizations 1.6.4
  - with TCP wrappers 1.7, 1.7.1.2
  - zones 1.6.2
- core files 2.7
- data 1.4
- files 2.6
- file systems 2.5
- inetd applications
  - with TCP wrappers 1.7.1.2
- IP packets
  - IPsec and IKE 1.7.2.1
- kernel 1.2.2
- legacy services 2.7
- network 2.4
- services
  - with SMF authorizations 1.6.4
- users 2.3
- users with rights 1.5
publications
- security and UNIX B.2

R

RBAC 1
references for Oracle Solaris B
remote access
- defending against 1.7.2
Remote Administration Daemon (RAD) 1.4.3
repositories
- package verification 3.1
restricting
- access through Kerberos 1.7.2.3
- data flows with label-based MAC policies 1.8.2
rights 1
- managing 1.5.3
- new security features 1.1.5
- protecting users 1.5
rights profiles
- Basic Solaris User 1.2.1
- Console User 1.2.1
- System Administrator 1.2.1
role-based access control (RBAC) 1
roles
- ARMOR 1.5
- predefined 1.5
- root 1.2.1
root role
- file permissions and 2.6
- initial assignment 1.2.1
rsyslog daemon 1.1.3, 3.2
running
- secure applications 1.9

S

SASL 1.1.6
secure by default 1.2
Secure Shell (SSH)
- encrypted key wrapper 1.2.1
- FIPS 140-2 and 1.7.2.2
- remote access 1.7.2.2
- version of OpenSSH 1.1.6
security
- after installation 1.2
- configurable 1.3
- label-based 1.8, 2.9
- maintaining system 3.2
- multilevel 2.9
- new features in this release 1.1
- policy 1.10
- publications B.2
- references B
- site security policy A
- system access and 2.7
- users and 2.3, 2.7
security compliance 1
security extensions
- adiheap 1.1.3
- adistack 1.1.3
- inheriting configuration of 1.1.3
- per object 1.1.3
- preventing corruption 1.6
- protecting the kernel 1.6.3
security features
- ASLR 1.6
- auditing 3.2
- Automated Installer (AI) 2.1
- BART 3.2
- compliance assessment and reports 3.2
- Cryptographic Framework 1.4.2
- identity service 1.4.3
- immutable zones 1.6.2
- IPsec and IKE 1.7.2.1
- Java Cryptography Extension 1.6.5
- Kerberos 1.7.2.3
- kernel zones 1.6.2
- Key Management Framework 1.4.2, 1.4.3
- labeled file system 1.8.2
- labeled network 1.8.2
- labeled security 1.8
- network access, limited 1.2.1
- new in this release 1.1
- Oracle Hardware Management Package 1.2.3
- package verification 3.1
- Packet Filter firewall 1.7.1.1
- packet filtering 1.7.1.1
- PAM 1.5.2
- password requirements 1.2.1
- passwords 1.5.1
- privileges 1.2.2, 1.6.1
- repository verification 3.1
- rights 1.5, 1.5.3
- role login, no 1.2.1
- roles 1.5
- root role 1.2.1
- secure by default 1.2
- Secure Shell (SSH) 1.7.2.2
- security extension framework 1.6.3
- security extensions 1.6
- Service Management Facility (SMF) 1.6.4
- TCP wrappers 1.7, 1.7.1.2
- Trusted Extensions 1.8.2
- user rights 1.5
- verified boot 3.1
- ZFS file system 1.2.2
- zones 1.6.2
security keywords 1
security policy 1
- training users A.8.1
sendmail
- TCP wrappers and 1.7.1.2
Service Management Facility (SMF)
- application protection and 2.8
- rights and 1.6.4
services
- authorizations in SMF, and 1.6.4
- inetd
  - protecting with TCP wrappers 1.7.1.2
- protecting
  - legacy applications 2.8
  - with SMF authorizations 1.6.4
SHA256 password hash 1.2.1
signature-policy
- property on images and package publishers 3.1
signatures
- packages and 3.1
- verifying package 3.1
site security policies
- overview 1.10
- per service with TCP wrappers 1.7.1.2
site security policy
- common violations A.7
- equipment retirement recommendations A.6
- Oracle Solaris configuration decisions A.2
- personnel recommendations A.5
- physical access recommendations A.4
- recommendations A.3
- tasks involved A
SMF 1
solaris-desktop package 2.1
solaris-large-server package 2.1
solaris-minimal-server package 2.1
solaris-small-server package 2.1
SPARC T series servers
- verified boot and 3.1
StatsStore
- contains auditing data 1.1.8
storage
- remotely for assessments 1.1.1
Support Repository Updates (SRU)
- monitoring 3
sxadm command
- managing security extenstions 1.1.3
System Administrator rights profile 1.2.1
systems
- default access 1.2.1
- initial configuration 2.2
- monitoring 3, 3.2
- securing access to 1.2.1
- security features for 1.2.1
system-wide settings
- account-policy SMF stencil 1.1.5

T

tags on assessments 1.1.1
TCP wrappers
- configuring 2.4
- protecting applications with 1.7, 1.7.1.2
timed account unlocking 1.1.5
tmpfs
- protecting 2.5
Trusted Extensions
- configuring 2.9
- labeled security and 1.8.2, 2.9
- labeling data flows 1.8.2
trusted package 2.9
two-factor authentication (2FA) 1

U

umask default 1.2.2
unlock_after user attribute 1.1.5
user rights 1
users
- deletion precautions A.8.7
- protecting 2.3
- protecting with rights 1.5
- security precautions A.8.6
- security training A.8, A.8.6
- timed account unlocking 1.1.5

V

verified boot
- firmware requirements 1.1.3
- system security and 3.1
verifying
- file integrity 3.2
- packages 3.1
- package signatures 3.1

W

WARNDAYS password variable 1.1.6

X

X.509 certificates 1.4.3

Z

ZFS
- chmod S+vnounlink command 2.6
- default file system 1.2.2
- file systems 1.4.4
- file systems, protecting 2.5
- new security features 1.1.4
- preventing file deletion 2.6
- umask and 1.2.2
zones
- immutable 1.6.2
- isolating applications 1.6, 2.7
- kernel 1.6.2
- resources 2.7