Skip to Content
Sun and Oracle
Channel Sun
How to Buy
Log In
繁體中文
docs.sun.com 首頁
>
Solaris Trusted Extensions Collection
> Solaris Trusted Extensions Administrator's Procedures
Solaris Trusted Extensions Administrator's Procedures
只搜尋這本書
搜尋說明
包含在
Solaris Trusted Extensions Collection
尋找其他文件
瀏覽文件標題
瀏覽產品文件
熱門支援資源
Sun 訓練課程
BigAdmin 系統管理入口網站
Sun 支援中心
Sun Solve
以 PDF 格式下載這本書 (3722 KB)
Solaris Trusted Extensions Administrator's Procedures
Index
Numbers and Symbols
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
R
S
T
U
V
W
X
Z
Book Information
Preface
Who Should Use This Book
Trusted Extensions and the Solaris Operating System
How the Solaris Trusted Extensions Books Are Organized
Related Books From Sun Microsystems
Books From Elsewhere
Related Third-Party Web Site References
Documentation, Support, and Training
Sun Welcomes Your Comments
Typographic Conventions
Shell Prompts in Command Examples
Initial Configuration of Trusted Extensions
1. Security Planning for Trusted Extensions
Planning for Security in Trusted Extensions
Understanding Trusted Extensions
Understanding Your Site's Security Policy
Devising an Administration Strategy for Trusted Extensions
Devising a Label Strategy
For International Customers of Trusted Extensions
Planning System Hardware and Capacity for Trusted Extensions
Planning Your Trusted Network
Planning for Zones in Trusted Extensions
Trusted Extensions Zones and Solaris Zones
Zone Creation in Trusted Extensions
Planning for Multilevel Access
Planning for the LDAP Naming Service in Trusted Extensions
Planning for Auditing in Trusted Extensions
Planning User Security in Trusted Extensions
Devising a Configuration Strategy for Trusted Extensions
Collecting Information Before Enabling Trusted Extensions
Backing Up the System Before Enabling Trusted Extensions
Results of Enabling Trusted Extensions From an Administrator's Perspective
2. Configuration Roadmap for Trusted Extensions
Task Map: Preparing a Solaris System for Trusted Extensions
Task Map: Preparing For and Enabling Trusted Extensions
Task Map: Configuring Trusted Extensions
3. Adding Solaris Trusted Extensions Software to the Solaris OS (Tasks)
Initial Setup Team Responsibilities
Installing or Upgrading the Solaris OS for Trusted Extensions
Install a Solaris System to Support Trusted Extensions
Prepare an Installed Solaris System for Trusted Extensions
Collecting Information and Making Decisions Before Enabling Trusted Extensions
Collect System Information Before Enabling Trusted Extensions
Make System and Security Decisions Before Enabling Trusted Extensions
Enabling the Solaris Trusted Extensions Service
Enable Solaris Trusted Extensions
4. Configuring Trusted Extensions (Tasks)
Setting Up the Global Zone in Trusted Extensions
Check and Install Your Label Encodings File
Enable IPv6 Networking in Trusted Extensions
Configure the Domain of Interpretation
Create ZFS Pool for Cloning Zones
Reboot and Log In to Trusted Extensions
Initialize the Solaris Management Console Server in Trusted Extensions
Make the Global Zone an LDAP Client in Trusted Extensions
Creating Labeled Zones
Run the txzonemgr Script
Configure the Network Interfaces in Trusted Extensions
Name and Label the Zone
Install the Labeled Zone
Boot the Labeled Zone
Verify the Status of the Zone
Customize the Labeled Zone
Copy or Clone a Zone in Trusted Extensions
Adding Network Interfaces and Routing to Labeled Zones
Add a Network Interface to Route an Existing Labeled Zone
Add a Network Interface That Does Not Use the Global Zone to Route an Existing Labeled Zone
Configure a Name Service Cache in Each Labeled Zone
Creating Roles and Users in Trusted Extensions
Create Rights Profiles That Enforce Separation of Duty
Create the Security Administrator Role in Trusted Extensions
Create a Restricted System Administrator Role
Create Users Who Can Assume Roles in Trusted Extensions
Verify That the Trusted Extensions Roles Work
Enable Users to Log In to a Labeled Zone
Creating Home Directories in Trusted Extensions
Create the Home Directory Server in Trusted Extensions
Enable Users to Access Their Home Directories in Trusted Extensions
Adding Users and Hosts to an Existing Trusted Network
Add an NIS User to the LDAP Server
Troubleshooting Your Trusted Extensions Configuration
netservices limited Was Run After Trusted Extensions Was Enabled
Cannot Open the Console Window in a Labeled Zone
Labeled Zone Is Unable to Access the X Server
Additional Trusted Extensions Configuration Tasks
How to Copy Files to Portable Media in Trusted Extensions
How to Copy Files From Portable Media in Trusted Extensions
How to Remove Trusted Extensions From the System
5. Configuring LDAP for Trusted Extensions (Tasks)
Configuring an LDAP Server on a Trusted Extensions Host (Task Map)
Configuring an LDAP Proxy Server on a Trusted Extensions Host (Task Map)
Configuring the Sun Java System Directory Server on a Trusted Extensions System
Collect Information for the Directory Server for LDAP
Install the Sun Java System Directory Server
Configure the Logs for the Sun Java System Directory Server
Configure a Multilevel Port for the Sun Java System Directory Server
Populate the Sun Java System Directory Server
Creating a Trusted Extensions Proxy for an Existing Sun Java System Directory Server
Create an LDAP Proxy Server
Configuring the Solaris Management Console for LDAP (Task Map)
Register LDAP Credentials With the Solaris Management Console
Enable the Solaris Management Console to Accept Network Communications
Edit the LDAP Toolbox in the Solaris Management Console
Verify That the Solaris Management Console Contains Trusted Extensions Information
6. Configuring a Headless System With Trusted Extensions (Tasks)
Headless System Configuration in Trusted Extensions (Task Map)
Enable Remote Login by root User in Trusted Extensions
Enable Remote Login by a Role in Trusted Extensions
Enable Remote Login From an Unlabeled System
Use a Remote Solaris Management Console to Administer in the Files Scope
Enable the Remote Display of Administrative GUIs
Use the rlogin or ssh Command to Log In and Administer a Headless System in Trusted Extensions
Administration of Trusted Extensions
7. Trusted Extensions Administration Concepts
Trusted Extensions Software and the Solaris OS
Similarities Between Trusted Extensions and the Solaris OS
Differences Between Trusted Extensions and the Solaris OS
Multiheaded Systems and the Trusted Extensions Desktop
Basic Concepts of Trusted Extensions
Trusted Extensions Protections
Trusted Extensions and Access Control
Roles and Trusted Extensions
Labels in Trusted Extensions Software
Dominance Relationships Between Labels
Administrative Labels
Label Encodings File
Label Ranges
Account Label Range
Session Range
What Labels Protect and Where Labels Appear
8. Trusted Extensions Administration Tools
Administration Tools for Trusted Extensions
txzonemgr Script
Trusted CDE Actions
Device Allocation Manager
Solaris Management Console Tools
Trusted Extensions Tools in the Solaris Management Console
Security Templates Tool
Trusted Network Zones Tool
Client-Server Communication With the Solaris Management Console
Solaris Management Console Documentation
Label Builder in Trusted Extensions
Command Line Tools in Trusted Extensions
Remote Administration in Trusted Extensions
9. Getting Started as a Trusted Extensions Administrator (Tasks)
What's New in Trusted Extensions
Security Requirements When Administering Trusted Extensions
Role Creation in Trusted Extensions
Role Assumption in Trusted Extensions
Getting Started as a Trusted Extensions Administrator (Task Map)
How to Enter the Global Zone in Trusted Extensions
How to Exit the Global Zone in Trusted Extensions
How to Administer the Local System With the Solaris Management Console
How to Start CDE Administrative Actions in Trusted Extensions
How to Edit Administrative Files in Trusted Extensions
10. Security Requirements on a Trusted Extensions System (Overview)
Configurable Solaris Security Features
Trusted Extensions Interfaces for Configuring Security Features
Extension of Solaris Security Mechanisms by Trusted Extensions
Trusted Extensions Security Features
Security Requirements Enforcement
Users and Security Requirements
Email Usage
Password Enforcement
Information Protection
Password Protection
Group Administration
User Deletion Practices
Rules When Changing the Level of Security for Data
sel_config File
Customization of Solaris Trusted Extensions (CDE)
Front Panel Customization
Workspace Menu Customization
11. Administering Security Requirements in Trusted Extensions (Tasks)
Common Tasks in Trusted Extensions (Task Map)
How to Assign the Editor of Your Choice as the Trusted Editor
How to Change the Password for root
How to Regain Control of the Desktop's Current Focus
How to Obtain the Hexadecimal Equivalent for a Label
How to Obtain a Readable Label From Its Hexadecimal Form
How to Change Security Defaults in System Files
12. Users, Rights, and Roles in Trusted Extensions (Overview)
User Security Features in Trusted Extensions
Administrator Responsibilities for Users
System Administrator Responsibilities for Users
Security Administrator Responsibilities for Users
Decisions to Make Before Creating Users in Trusted Extensions
Default User Security Attributes in Trusted Extensions
label_encodings File Defaults
policy.conf File Defaults in Trusted Extensions
Configurable User Attributes in Trusted Extensions
Security Attributes That Must Be Assigned to Users
Security Attribute Assignment to Users in Trusted Extensions
.copy_files and .link_files Files
13. Managing Users, Rights, and Roles in Trusted Extensions (Tasks)
Customizing the User Environment for Security (Task Map)
How to Modify Default User Label Attributes
How to Modify policy.conf Defaults
How to Configure Startup Files for Users in Trusted Extensions
How to Lengthen the Timeout When Relabeling Information
How to Log In to a Failsafe Session in Trusted Extensions
Managing Users and Rights With the Solaris Management Console (Task Map)
How to Modify a User's Label Range in the Solaris Management Console
How to Create a Rights Profile for Convenient Authorizations
How to Restrict a User's Set of Privileges
How to Prevent Account Locking for Users
How to Hide Labels From a User
How to Enable a User to Change the Security Level of Data
How to Delete a User Account From a Trusted Extensions System
Handling Other Tasks in the Solaris Management Console (Task Map)
14. Remote Administration in Trusted Extensions (Tasks)
Secure Remote Administration in Trusted Extensions
Methods for Administering Remote Systems in Trusted Extensions
Remote Login by a Role in Trusted Extensions
Remote Role-Based Administration From Unlabeled Hosts
Remote Login Management in Trusted Extensions
Administering Trusted Extensions Remotely (Task Map)
How to Log In Remotely From the Command Line in Trusted Extensions
How to Remotely Administer Trusted Extensions With dtappsession
How to Remotely Administer Systems by Using the Solaris Management Console From a Trusted Extensions System
How to Remotely Administer Systems by Using the Solaris Management Console From an Unlabeled System
How to Enable Specific Users to Log In Remotely to the Global Zone in Trusted Extensions
How to Use Xvnc to Remotely Access a Trusted Extensions System
15. Trusted Extensions and LDAP (Overview)
Using a Naming Service in Trusted Extensions
Non-Networked Trusted Extensions Systems
Trusted Extensions LDAP Databases
Using the LDAP Naming Service in Trusted Extensions
16. Managing Zones in Trusted Extensions (Tasks)
Zones in Trusted Extensions
Zones and IP Addresses in Trusted Extensions
Zones and Multilevel Ports
Zones and ICMP in Trusted Extensions
Global Zone Processes and Labeled Zones
Zone Administration Utilities in Trusted Extensions
Managing Zones (Task Map)
How to Display Ready or Running Zones
How to Display the Labels of Mounted Files
How to Loopback Mount a File That Is Usually Not Visible in a Labeled Zone
How to Disable the Mounting of Lower-Level Files
How to Share a ZFS Dataset From a Labeled Zone
How to Enable Files to be Relabeled From a Labeled Zone
How to Configure a Multilevel Port for NFSv3 Over udp
How to Create a Multilevel Port for a Zone
17. Managing and Mounting Files in Trusted Extensions (Tasks)
Sharing and Mounting Files in Trusted Extensions
NFS Mounts in Trusted Extensions
Sharing Files From a Labeled Zone
Access to NFS Mounted Directories in Trusted Extensions
Home Directory Creation in Trusted Extensions
Changes to the Automounter in Trusted Extensions
Trusted Extensions Software and NFS Protocol Versions
Backing Up, Sharing, and Mounting Labeled Files (Task Map)
How to Back Up Files in Trusted Extensions
How to Restore Files in Trusted Extensions
How to Share Directories From a Labeled Zone
How to NFS Mount Files in a Labeled Zone
How to Troubleshoot Mount Failures in Trusted Extensions
18. Trusted Networking (Overview)
The Trusted Network
Trusted Extensions Data Packets
Trusted Network Communications
Network Configuration Databases in Trusted Extensions
Network Commands in Trusted Extensions
Trusted Network Security Attributes
Network Security Attributes in Trusted Extensions
Host Type and Template Name in Security Templates
Default Label in Security Templates
Domain of Interpretation in Security Templates
Label Range in Security Templates
Security Label Set in Security Templates
Trusted Network Fallback Mechanism
Overview of Routing in Trusted Extensions
Background on Routing
Routing Table Entries in Trusted Extensions
Trusted Extensions Accreditation Checks
Source Accreditation Checks
Gateway Accreditation Checks
Destination Accreditation Checks
Administration of Routing in Trusted Extensions
Choosing Routers in Trusted Extensions
Gateways in Trusted Extensions
Routing Commands in Trusted Extensions
19. Managing Networks in Trusted Extensions (Tasks)
Managing the Trusted Network (Task Map)
Configuring Trusted Network Databases (Task Map)
How to Determine If You Need Site-Specific Security Templates
How to Open the Trusted Networking Tools
How to Construct a Remote Host Template
How to Add Hosts to the System's Known Network
How to Assign a Security Template to a Host or a Group of Hosts
How to Limit the Hosts That Can Be Contacted on the Trusted Network
Configuring Routes and Checking Network Information in Trusted Extensions (Task Map)
How to Configure Routes With Security Attributes
How to Check the Syntax of Trusted Network Databases
How to Compare Trusted Network Database Information With the Kernel Cache
How to Synchronize the Kernel Cache With Trusted Network Databases
Troubleshooting the Trusted Network (Task Map)
How to Verify That a Host's Interfaces Are Up
How to Debug the Trusted Extensions Network
How to Debug a Client Connection to the LDAP Server
20. Multilevel Mail in Trusted Extensions (Overview)
Multilevel Mail Service
Trusted Extensions Mail Features
21. Managing Labeled Printing (Tasks)
Labels, Printers, and Printing
Restricting Access to Printers and Print Job Information in Trusted Extensions
Labeled Printer Output
Labeled Body Pages
Labeled Banner and Trailer Pages
PostScript Printing of Security Information
Printer Model Scripts
Additional Conversion Filters
Interoperability of Trusted Extensions With Trusted Solaris 8 Printing
Trusted Extensions Print Interfaces (Reference)
Managing Printing in Trusted Extensions (Task Map)
Configuring Labeled Printing (Task Map)
How to Configure a Multilevel Print Server and Its Printers
How to Configure a Zone for Single-Label Printing
How to Enable a Trusted Extensions Client to Access a Printer
How to Configure a Restricted Label Range for a Printer
Reducing Printing Restrictions in Trusted Extensions (Task Map)
How to Remove Labels From Printed Output
How to Assign a Label to an Unlabeled Print Server
How to Remove Page Labels From All Print Jobs
How to Enable Specific Users to Suppress Page Labels
How to Suppress Banner and Trailer Pages for Specific Users
How to Enable Users to Print PostScript Files in Trusted Extensions
22. Devices in Trusted Extensions (Overview)
Device Protection With Trusted Extensions Software
Device Label Ranges
Effects of Label Range on a Device
Device Access Policies
Device-Clean Scripts
Device Allocation Manager GUI
Enforcement of Device Security in Trusted Extensions
Devices in Trusted Extensions (Reference)
23. Managing Devices for Trusted Extensions (Tasks)
Handling Devices in Trusted Extensions (Task Map)
Using Devices in Trusted Extensions (Task Map)
Managing Devices in Trusted Extensions (Task Map)
How to Configure a Device in Trusted Extensions
How to Revoke or Reclaim a Device in Trusted Extensions
How to Protect Nonallocatable Devices in Trusted Extensions
How to Configure a Serial Line for Logins
How to Configure an Audio Player Program for Use in Trusted CDE
How to Prevent the File Manager From Displaying After Device Allocation
How to Add a Device_Clean Script in Trusted Extensions
Customizing Device Authorizations in Trusted Extensions (Task Map)
How to Create New Device Authorizations
How to Add Site-Specific Authorizations to a Device in Trusted Extensions
How to Assign Device Authorizations
24. Trusted Extensions Auditing (Overview)
Trusted Extensions and Auditing
Audit Management by Role in Trusted Extensions
Role Setup for Audit Administration
Audit Tasks in Trusted Extensions
Audit Tasks of the Security Administrator
Audit Tasks of the System Administrator
Trusted Extensions Audit Reference
Trusted Extensions Audit Classes
Trusted Extensions Audit Events
Trusted Extensions Audit Tokens
label Token
xatom Token
xclient Token
xcolormap Token
xcursor Token
xfont Token
xgc Token
xpixmap Token
xproperty Token
xselect Token
xwindow Token
Trusted Extensions Audit Policy Options
Extensions to Auditing Commands in Trusted Extensions
25. Software Management in Trusted Extensions (Tasks)
Adding Software to Trusted Extensions
Solaris Security Mechanisms for Software
Evaluating Software for Security
Developer Responsibilities When Creating Trusted Programs
Security Administrator Responsibilities for Trusted Programs
Trusted Processes in the Window System
Adding Trusted CDE Actions
Managing Software in Trusted Extensions (Tasks)
How to Add a Software Package in Trusted Extensions
How to Install a Java Archive File in Trusted Extensions
A. Site Security Policy
Creating and Managing a Security Policy
Site Security Policy and Trusted Extensions
Computer Security Recommendations
Physical Security Recommendations
Personnel Security Recommendations
Common Security Violations
Additional Security References
U.S. Government Publications
UNIX Security Publications
General Computer Security Publications
General UNIX Publications
B. Using CDE Actions to Install Zones in Trusted Extensions
Associating Network Interfaces With Zones by Using CDE Actions (Task Map)
Specify Two IP Addresses for the System by Using a CDE Action
Specify One IP Address for the System by Using a CDE Action
Preparing to Create Zones by Using CDE Actions (Task Map)
Specify Zone Names and Zone Labels by Using a CDE Action
Specify Labels for Network Interfaces by Using the Solaris Management Console
Creating Labeled Zones by Using CDE Actions (Task Map)
Install, Initialize, and Boot a Labeled Zone by Using CDE Actions
Resolve Local Zone to Global Zone Routing in Trusted CDE
Customize a Booted Zone in Trusted Extensions
Use the Copy Zone Method in Trusted Extensions
Use the Clone Zone Method in Trusted Extensions
C. Configuration Checklist for Trusted Extensions
Checklist for Configuring Trusted Extensions
D. Quick Reference to Trusted Extensions Administration
Administrative Interfaces in Trusted Extensions
Solaris Interfaces Extended by Trusted Extensions
Tighter Security Defaults in Trusted Extensions
Limited Options in Trusted Extensions
E. List of Trusted Extensions Man Pages
Trusted Extensions Man Pages in Alphabetical Order
Solaris Man Pages That Are Modified by Trusted Extensions
Glossary
News Center
About Sun
Contact Sun
Terms of Use
Privacy
Copyright
1994-2009
Sun Microsystems, Inc.
以 PDF 格式下載這本書 (3722 KB)