Chapter 2 Working With the Solaris^TM Management Console (Tasks)

This chapter provides an overview of the Solaris management tools used to perform system administration tasks. Topics include starting the Solaris Management Console (console), setting up Role-Based Access Control (RBAC) to use with the console, and working with the Solaris management tools in a name service environment.

For information on the procedures associated with performing system management tasks with the Solaris Management Console, see:

• Using the Solaris Management Tools With RBAC (Task Map)

• Using the Solaris Management Tools in a Name Service Environment (Task Map)

For information on troubleshooting Solaris Management Console problems, see Troubleshooting the Solaris Management Console.

Solaris Management Console (Overview)

The following sections provide information about the Solaris Management Console.

What Is the Solaris Management Console?

The Solaris Management Console is a container for GUI-based management tools that are stored in collections referred to as toolboxes. The console includes a default toolbox with many basic management tools, including tools for managing users, projects, and cron jobs; for mounting and sharing file systems; and for managing disks and serial ports. For a brief description of each Solaris management tool, see Table 2–1.

You can always add tools to the existing toolbox, or you can create new toolboxes.

The Solaris Management Console has three primary components:

• The Solaris Management Console Client

  Called console, this is the visible interface and contains the GUI tools used to perform management tasks.

• The Solaris Management Console Server

  This component is located either on the same machine as the console or remotely, and provides all the back end functionality that allows management through the console.

• The Solaris Management Console Toolbox Editor

  This application, which looks similar to the console, is used to add or modify toolboxes, to add tools to a toolbox, or to extend the scope of a toolbox. For example, you would add a toolbox to manage a name service domain.

The default toolbox is visible when you start the console.

Solaris Management Console Tools

This table describes the tools included in the default Solaris Management Console toolbox and provides cross-references to background information for each tool.

Context–sensitive help is available after you start a tool. For broader, more in-depth online information than the context help provides, see the expanded help topics, which you can reach from the console Help menu.

Why Use the Solaris Management Console?

The console provides a set of tools with many benefits for administrators. The console does the following:

• Supports all experience levels

  Inexperienced administrators can complete tasks by using the graphical interface, which includes dialog boxes, wizards, and context help. Experienced administrators will find that the console provides a convenient, secure alternative to using vi to manage hundreds of configuration parameters spread across tens or hundreds of systems.

• Controls user access to the system

  Although any user can access the console by default, only superuser can make changes in the initial configuration. As described in “Role-Based Access Control (Overview)” in System Administration Guide: Security Services, it is possible to create special user accounts called roles that can be assigned to users, typically administrators, who are permitted to make specific system changes.

  The key benefit of RBAC is that roles can be limited to only those tasks that are necessary for doing their jobs. RBAC is not required for using the Solaris management tools. You can run all tools as superuser without making any changes.

• Provides a command line interface

  If preferred, administrators can operate the Solaris management tools through a command-line interface (CLI). Some commands are written specifically to mimic the GUI tool functions, such as the commands for managing users. These new commands are listed in Table 1–6, with the names and brief descriptions of each command. There is also a man page for each command.

  For those Solaris management tools that have no special commands, such as the Mounts and Shares tools, use the standard UNIX commands.

For in-depth information about how RBAC works, its benefits, and how to apply those benefits to your site, see “Role-Based Access Control (Overview)” in System Administration Guide: Security Services.

To learn more about using RBAC with the Solaris management tools, see Using the Solaris Management Tools With RBAC (Task Map).

Organization of the Solaris Management Console

In the following figure, the console is shown with the Users Tool open.

The main part of the console consists of three panes:

Figure 2–1 Solaris Management Console – Users Tool

• Navigation pane (at the left) – For accessing tools (or sets of tools), folders, or other toolboxes. Icons in the navigation pane are called nodes and are expandable if they are folders or toolboxes.

• View pane (at the right) – For viewing information related to the node selected in the navigation pane, shows either the contents of the selected folder, subordinate tools, or data associated with the selected tool.

• Information pane (at the bottom) – For displaying context-sensitive help or console events.

Changing the Solaris Management Console Window

The layout of the console window is highly configurable. You can use the following features to change the console window layout:

• View menu – Use the Show option in the View menu to hide or display the optional bars and panes. The other options in the View menu control the display of nodes in the view pane.

• Console menu – Use the Preferences option to set the following: the initial toolbox, the orientation of panes, clicking or double-clicking for selection, text or icons in the tool bar, fonts, default tool loading, authentication prompts, and advanced logins.

• Context Help or Console Events toggles – Use the icons at the bottom of the information pane to toggle between the display of context-sensitive help and console events.

Solaris Management Console Documentation

The main source of documentation for using the console and its tools is the online help system. Two forms of online help are available: context-sensitive help and expanded help topics.

• Context-sensitive help responds to your use of the console tools.

  Clicking the cursor on tabs, entry fields, radio buttons, and so forth, causes the appropriate help to appear in the Information pane. You can close, or reopen the Information pane by clicking the question mark button on dialog boxes and wizards.

• Expanded help topics are available from the Help menu or by clicking cross reference links in some context-sensitive help.

  These topics appear in a separate viewer and contain more in-depth information than is provided by the context help. Topics include overviews of each tool, explanations of how each tool works, files used by a specific tool, and troubleshooting.

For a brief overview of each tool, refer to Table 2–1.

How Much Role-Based Access Control?

As described in Why Use the Solaris Management Console?, a major advantage of using the Solaris management tools is the ability to use Role-Based Access Control (RBAC). RBAC provides administrators with access to just the tools and commands they need to perform their jobs.

Depending on your security needs, you can use varying degrees of RBAC, as follows:

Becoming Superuser (root) or Assuming a Role

Most administration tasks, such as adding users, file systems, or printers, require that you first log in as root (UID=0) or assume a role if you are using RBAC. The root account, also known as the superuser account, is used to make system changes and can override user file protection in emergency situations.

The superuser account and roles should be used only to perform administrative tasks to prevent indiscriminate changes to the system. The security problem associated with the superuser account is that a user has complete access to the system even when performing minor tasks.

In a non-RBAC environment, you can either log into the system as superuser or use the su command to change to the superuser account. If RBAC is implemented, you can assume roles through the console or use su and specify a role.

When you use the console to perform administration tasks, you can do one of the following:

• Log into the console as yourself and then supply the root user name and password.

• Log into the console as yourself and then assume a role.

A major benefit of RBAC is that roles can be created to give limited access to specific functions only. If you are using RBAC, you can run restricted applications by assuming a role rather than becoming superuser.

For step-by-step instructions on creating the Primary Administrator role, see How to Create the First Role (Primary Administrator). For an overview on configuring RBAC to use roles, see “Configuring RBAC (Task Map)” in System Administration Guide: Security Services.

How to Become Superuser (root) or Assume a Role

Become superuser or assume a role by using one of the following methods. Each method requires that you know either the superuser password or the role password.

1. Select one of the following to become superuser.

   • Log in as a user, start the Solaris Management Console, select a Solaris management tool, and then log in as root.

     This method enables to you perform any management task from the console.

     For information on starting the Solaris Management Console, see How to Start the Solaris Management Console in a Name Service Environment.

   • Log in as superuser on the system console.

     hostname console: root Password: root-password #

     The pound sign (#) is the Bourne shell prompt for the superuser account.

     This method provides complete access to all system commands and tools.

   • Log in as a user, and then change to the superuser account by using the su command at the command line.

     % su Password: root-password #

     This method provides complete access to all system commands and tools.

   • Log in remotely as superuser. This method is not enabled by default. You must modify the /etc/default/login file to remotely log in as superuser on the system console. For information on modifying this file, see “Securing Machines (Tasks)” in System Administration Guide: Security Services.

     This method provides complete access to all system commands and tools.

2. Select one of the following to assume a role.

   • Log in as user, and then change to a role by using the su command at the command line.

     % su role Password: role-password $

     This method provides access to all the commands and tools the role has access to.

   • Log in as a user, start the Solaris Management Console, select a Solaris management tool, and then assume a role.

     For information on starting the Solaris Management Console, see How to Start the Console as Superuser or as a Role.

     This method provides access to the Solaris management tools that the role has access to.

Using the Solaris Management Tools With RBAC (Task Map)

This task map describes the tasks to do if you want to use the Role-Based Access Control (RBAC) security features rather than use the superuser account to perform administration tasks.

The information in this chapter describes how to use the console with RBAC. RBAC overview and task information is included to show you how to initially setup RBAC with the console.

For detailed information on RBAC and using it with other applications, see “Role-Based Access Control (Overview)” in System Administration Guide: Security Services.

The following sections provide overview information and step-by-step instructions for using the Solaris Management Console and the RBAC security features.

If You Are the First to Log In to the Console

If you are the first administrator to log in to the console, start the console as a user (yourself), and then log in as superuser. This method gives you complete access to all the console tools.

Here are the general steps, depending on whether or not you are using RBAC:

• Without RBAC – If you choose not to use RBAC, continue working as superuser. All other administrators will also need root access to perform their jobs.

• With RBAC – You'll need to do the following:

  • Set up your user account, if you do not already have one.

  • Create the role called Primary Administrator.

  • Assign the Primary Administrator right to the role you are creating.

  • Assign your user account to this role.

    For step-by-step instructions on creating the Primary Administrator role, see How to Create the First Role (Primary Administrator).

    For an overview on configuring RBAC to use roles, see “Configuring RBAC (Task Map)” in System Administration Guide: Security Services.

Creating the Primary Administrator Role

An administrative role is a special user account. Users who assume a role are permitted to perform a pre-defined set of administrative tasks.

The Primary Administrator role is permitted to perform all administrative functions, similar to superuser.

If you are superuser, or a user assuming the Primary Administrator role, you can define which tasks other administrators are permitted to perform. With the help of the Add Administrative Role wizard, you can create a role, grant rights to the role, and then specify which users are permitted to assume that role. A right is a named collection of commands, or authorizations, for using specific applications or for performing specific functions within an application, and other rights, whose use can be granted or denied by an administrator.

You are prompted for the following information when you create the Primary Administrator role:

For detailed information about Role-Based Access Control, and how to use roles to create a more secure environment, see “Role-Based Access Control (Overview)” in System Administration Guide: Security Services.

How to Create the First Role (Primary Administrator)

This procedure describes how to create the Primary Administrator role and then assign it to your user account. This procedure assumes that your user account is already created.

1. Start the console as yourself.

   % /usr/sadm/bin/smc &

   For additional information on starting the console, see How to Start the Console as Superuser or as a Role.

   See the console online help if you need to create a user account for yourself.

2. Click This Computer icon in the Navigation pane.

3. Click System Configuration->Users->Administrative Roles.

4. Click Action->Add Administrative Role.

   The Add Administrative Role wizard opens.

5. Create the Primary Administrator role with the Administrative Role wizard by following these steps.

   1. Identify the role name, full role name, description, role ID number, role shell, and whether you want to create a role mailing list. Click Next.

   2. Set and confirm the role password. Click Next.

   3. Select the Primary Administrator right from the Available Rights column and add it to Granted Rights column. Click Next.

   4. Select the home directory for the role. Click Next.

   5. Assign yourself to the list of users who can assume the role. Click Next.

   If necessary, see Table 2–2 for a description of the role items.

6. Click Finish.

How to Assume the Primary Administrator Role

After you have created the Primary Administrator role, log in to the console as yourself, and then assume the Primary Administrator role.

When you assume a role, you take on all the attributes of that role, including the rights. At the same time, you relinquish all of your own user properties.

1. Start the console.

   % /usr/sadm/bin/smc &

   For information on starting the console, see How to Start the Console as Superuser or as a Role.

2. Log in with your user name and password.

   A list shows which roles you are permitted to assume.

3. Log in to the Primary Administrator role and provide the role password.

Starting the Solaris Management Console

The following procedure describes how to start the console and gain access to the Solaris management tools.

How to Start the Console as Superuser or as a Role

If you start the console as a user, with your own user account, you have limited access to the Solaris management tools. For greater access, you can log in as yourself and then as one of the roles you are allowed to assume. If you are permitted to assume the role of Primary Administrator, you then have access to all the Solaris management tools, equivalent to that of superuser.

1. Verify that you are in a window environment, such as the CDE environment.

2. Start the console in one of the following ways.

   • From the command line, type:

     % /usr/sadm/bin/smc &

     It might take a minute or two for the console to come up the first time.

   • From the Tools menu of the CDE front panel.

   • By double-clicking a Solaris Management Console icon in CDE's Applications Manager or File Manager.

   The Solaris Management Console window is displayed.

   ---

   Note –

   Open a console in your window environment to display the Solaris Management Console start-up messages. Do not attempt to start the Solaris Management Console server manually before starting the Solaris Management Console. The server starts automatically when you start the Solaris Management Console. For information on troubleshooting console problems, see Troubleshooting the Solaris Management Console.

   ---

3. Double-click the This Computer icon under the Management Tools icon in the Navigation pane.

   A list of categories is displayed.

4. (Optional) Select the appropriate toolbox.

   If you want to use a toolbox other than the default toolbox, select the appropriate toolbox from the Navigation pane. Or, select Open Toolbox from the console menu and load the toolbox you want.

   For information about using different toolboxes, see How to Create a Toolbox for a Specific Environment.

5. Double-click the category icon to access a particular tool.

   Use the online help to identify how to perform a specific task.

6. Double-click the tool icon.

   A popup Log-In window is displayed.

7. Decide if you want to the tool as superuser or as a role.

   • If you are logging in as superuser and will be working as superuser, select step 8.

   • If you are logging in as yourself and will be assuming the Primary Administrator role, select steps 9 and 10.

8. If you are logging in as superuser, enter the root password.

9. If you are logging in as yourself, backspace over the root user name. Then supply your user ID and user password.

   A list of roles you can assume is displayed.

10. Select the Primary Administrator role, or an equivalent role, and supply the role password.

    For step-by-step instructions on creating the Primary Administrator role, see How to Create the First Role (Primary Administrator).

    The main tool menu is displayed.

Using the Solaris Management Tools in a Name Service Environment (Task Map)

By default, the Solaris management tools are set up to operate in a local environment. For example, the Mounts and Shares tool enables you to mount and share directories on specific systems, but not in a NIS or NIS+ environment. However, you can manage information with the Users and Computers and Networks tools in a name service environment.

To work with a console tool in a name service environment, you need to create a name service toolbox, and then add the tool to that toolbox.

RBAC Security Files

The RBAC security files that work with the Solaris Management Console are created when you upgrade to or install the Solaris 9 release. If you do not install the Solaris Management Console packages, the RBAC security files are installed without the necessary data for using RBAC. For information on the Solaris Management Console packages, see Troubleshooting the Solaris Management Console.

The RBAC security files in the Solaris 9 release are included in your name service so that you can use the Solaris Management Console tools in a name service environment.

The security files on a local server are populated into a name service environment as part of a standard upgrade by the ypmake, nispopulate, or equivalent LDAP commands. The following name services are supported:

• NIS

• NIS+

• LDAP

• files

The projects database is not supported in the NIS+ environment.

The RBAC security files are created when you upgrade to or install the Solaris 9 release.

This table briefly describes the pre-defined security files that are installed on a Solaris 9 system.

For unusual upgrade cases, you might have to use the smattrpop command to populate RBAC security files in the following instances:

• When creating or modifying rights profiles, or

• When you need to include users and roles by customizing the usr_attr file.

For more information, see “Role-Based Access Control (Overview)” in System Administration Guide: Security Services.

Prerequisites for Using the Solaris Management Console in a Name Service Environment

The following table identifies what you need to do before you can use the Solaris Management Console in a name service environment.

Management Scope

The Solaris Management Console uses the term management scope to refer to the name service environment that you want to use with the selected management tool. The management scope choices for the Users and Computers and Networks tools are LDAP, NIS, NIS+, or files.

The management scope that you select during a console session should correspond to the primary name service identified in the /etc/nsswitch.conf file.

The /etc/nsswitch.conf File

The /etc/nsswitch.conf file on each system specifies the policy for name service lookups (where data is read from) on that system.

You must make sure that the name service accessed from the console, which you specify through the console Toolbox Editor, appears in the search path of the /etc/nsswitch.conf file. If the specified name service does not appear there, the tools might behave in unexpected ways, resulting in errors or warnings.

When using the Solaris managements tools in a name service environment, you might impact many users with a single operation. For example, if you delete a user in the NIS name service, that user is deleted on all systems that are using NIS.

If different systems in your network have different /etc/nsswitch.conf configurations, unexpected results might occur. So, all systems to be managed with the Solaris management tools should have a consistent name service configuration.

How to Create a Toolbox for a Specific Environment

Applications for administering the Solaris operating environment are called tools, and those tools are stored in collections referred to as toolboxes. A toolbox can be located on a local server, where the console is located, or on a remote machine.

Use the Toolbox Editor to add a new toolbox, to add tools to an existing toolbox, or to change the scope of a toolbox. For example, to change the domain from local files to a name service.

You can start the Toolbox Editor as a normal user. However, if you plan to make changes and save them to the default console toolbox (/var/sadm/smc/toolboxes), you must start the Toolbox Editor as root.

1. Start the Toolbox Editor.

   # /usr/sadm/bin/smc edit &

2. Select Open from the Toolbox menu.

3. Select the This Computer icon in the Toolboxes: window.

4. Click Open.

   The This Computer toolbox opens in the window.

5. Select the This Computer icon again in the Navigation pane.

6. Select Add Folder from the Action menu.

7. Use the Folder wizard to add a new toolbox for your name service environment.

   1. Name and Description – Provide a name in the Full Name window. Click Next.

      For example, “NIS tools” for the NIS environment.

   2. Provide a description in the Description window. Click Next.

      For example, “tools for NIS environment.”

   3. Icons – Use the default value for the Icons. Click Next.

   4. Management Scope – Select Override.

   5. Select your name service under the Management Scope pull-down menu.

   6. Add the name service master name in the Server: field, if necessary.

   7. Add the domain managed by the server in the Domain: field.

   8. Click Finish.

      The new toolbox appears in the left Navigation pane.

8. Select the new toolbox icon.

9. Select Save As from the Toolbox menu.

10. Enter the toolbox path name in the Local Toolbox Filename: dialog box. Use the .tbx suffix.

    /var/sadm/smc/toolboxes/this_computer/toolbox-name.tbx

11. Click Save.

    The new toolbox appears in the Navigation pane in the console window.

Where to Go From Here

After you have created a name service toolbox, you can put a name service tool into it. For more information, see How to Add a Tool to a Toolbox.

How to Add a Tool to a Toolbox

In addition to the default tools that ship with the console, additional tools that can be launched from the console are being developed. As these tools become available, you can add one or more tools to an existing toolbox.

You can also create a new toolbox, for either local management or network management, and then add tools to the new toolbox.

1. Become superuser or assume an equivalent role.

2. Start the Toolbox Editor, if necessary.

   # /usr/sadm/bin/smc edit &

3. Select the toolbox.

   If you want to work in a name service, select the toolbox you just created in the Toolbox Editor.

   For more information, see How to Create a Toolbox for a Specific Environment.

4. Select Add Tool from the Action menu.

5. Use the Add Tool wizard to add the new tool.

   1. Server Selection – Add the name service master in the Server: window. Click Next.

   2. Tools Selection – Select the tool you want to add from the Tools: window. Click Next.

      If this tool box is a name service toolbox, choose a tool you want to work in a name service environment. For example, the Users Tools.

   3. Name and Description – Accept the default values. Click Next.

   4. Icons – Accept the default values, unless you have created custom icons. Click Next.

   5. Management Scope – Accept the default value “Inherit from Parent.” Click Next.

   6. Tool Loading – Accept the default “Load tool when selected.” Click Finish.

6. Select Save from the Toolbox menu to save the updated toolbox.

   The Local Toolbox window is displayed.

How to Start the Solaris Management Console in a Name Service Environment

After you have created a name service toolbox and have added tools to it, you can start the Solaris Management Console and open that toolbox to manage a name service environment.

1. Verify that the following prerequisites are met.

   1. Be sure the system you are logged into is configured to work in a name service environment.

   2. Verify that the /etc/nsswitch.conf file is configured to match your name service environment.

2. Start the Solaris Management Console.

   For more information, see How to Start the Console as Superuser or as a Role.

3. Select the toolbox you created for the name service, which appears in the Navigation pane.

   For information on creating a toolbox for a name service, see How to Create a Toolbox for a Specific Environment.

Adding Tools to the Solaris Management Console

This section describes how to add legacy tools or unbundled tools to the console. If you want to add authentication to these tools, see “Securing Legacy Applications” in System Administration Guide: Security Services.

How to Add a Legacy Tool to a Toolbox

A legacy tool is any application that was not designed specifically as a Solaris management tool. You can add three types of legacy tool applications, X applications, command-line interface, and HTML, to a console toolbox. Each tool you add to a toolbox can then be launched from the Solaris Management Console.

1. Become superuser or assume an equivalent role.

2. Start the Solaris Management Console Toolbox Editor, if necessary.

   # /usr/sadm/bin/smc edit &

3. Open the toolbox to which you want to add the legacy application.

   The toolbox selected is opened in the Toolbox Editor.

4. Select the node in the toolbox to which you want to add the legacy application.

   A legacy application can be added to the top node of a toolbox or to another folder.

5. Click Action->Add Legacy Application.

   The first panel of the Legacy Application Wizard: General is displayed.

6. Follow the instructions in the wizard.

7. Save the toolbox in the Editor.

How to Install an Unbundled Tool

Follow this procedure if you want to add a new tool package that can be launched from the console.

1. Become superuser or assume an equivalent role.

2. Install the new tool package.

   # pkgadd ABCDtool

3. Restart the console so that it recognizes the new tool.

   1. Stop the console server.

      # /etc/init.d/init.wbem stop

   2. Start the console server.

      # /etc/init.d/init.wbem start

4. Start the console to verify that the new tool is displayed.

   For more information, see How to Start the Console as Superuser or as a Role.

Troubleshooting the Solaris Management Console

Before using this troubleshooting procedure, make sure the following packages are installed:

SUNWmc         Solaris Management Console 2.1 (Server Components)
SUNWmcc        Solaris Management Console 2.1 (Client Components)
SUNWmccom      Solaris Management Console 2.1 (Common Components)
SUNWmcdev      Solaris Management Console 2.1 (Development Kit)
SUNWmcex       Solaris Management Console 2.1 (Examples)
SUNWwbmc       Solaris Management Console 2.1 (WBEM Components)

These packages provide the basic Solaris Management Console launcher. You must install the SUNWprog cluster to use the Solaris Management Console and all of its tools.

How to Troubleshoot the Solaris Management Console

The client and the server are started automatically when you start the Solaris Management Console.

If the console is visible and you are having trouble running the tools, it might be that the server is not running. Or, the server might be in a problem state that can be resolved by stopping and restarting it.

1. Become superuser or assume an equivalent role.

2. Determine whether the console server is running.

   # /etc/init.d/init.wbem status

   If the console server is running, you should see a message like the following:

   SMC server version 2.1.0 running on port 898.

3. If the console server is not running, start it.

   # /etc/init.d/init.wbem start

   After a short time, you should see a message like the following:

   SMC server is ready.

4. If the server is running and you are still having problems, stop the console server and then restart it.

   1. Stop the console server.

      # /etc/init.d/init.wbem stop

      You should see a message like the following:

      Shutting down SMC server on port 898.

   2. Start the console server.

      # /etc/init.d/init.wbem start