| Skip Navigation Links | |
|
Oracle Solaris 11.1 Administration: Security Services Oracle Solaris 11.1 Information Library |
Oracle Solaris 11.1 Administration: Security Services
February 2014
Explains how to administer security features on one or more Oracle Solaris systems.
- Document Information
- Preface
- Part I Security Overview
- Part II System, File, and Device Security
- 2. Managing Machine Security (Overview)
- Controlling Access to a Computer System
- Controlling Access to Devices
- Controlling Access to Machine Resources
- Address Space Layout Randomization
- Limiting and Monitoring Superuser Access
- Configuring Role-Based Access Control to Replace Superuser
- Preventing Unintentional Misuse of System Resources
- Restricting setuid Executable Files
- Using the Secure by Default Configuration
- Using Resource Management Features
- Using Oracle Solaris Zones
- Monitoring Use of Machine Resources
- Monitoring File Integrity
- Controlling Access to Files
- Controlling Network Access
- Reporting Security Problems
- 3. Controlling Access to Systems (Tasks)
- 4. Virus Scanning Service (Tasks)
- 5. Controlling Access to Devices (Tasks)
- Configuring Device Policy (Tasks)
- Managing Device Allocation (Tasks)
- Managing Device Allocation (Task Map)
- How to Enable Device Allocation
- How to Authorize Users to Allocate a Device
- How to View Allocation Information About a Device
- How to Forcibly Allocate a Device
- How to Forcibly Deallocate a Device
- How to Change Which Devices Can Be Allocated
- How to Audit Device Allocation
- Allocating Devices (Tasks)
- Device Protection (Reference)
- 6. Verifying File Integrity by Using BART (Tasks)
- BART (Overview)
- Using BART (Tasks)
- BART Security Considerations
- Using BART (Task Map)
- How to Create a Control Manifest
- How to Customize a Manifest
- How to Compare Manifests for the Same System Over Time
- How to Compare Manifests From Different Systems
- How to Customize a BART Report by Specifying File Attributes
- How to Customize a BART Report by Using a Rules File
- BART Manifests, Rules Files, and Reports (Reference)
- 7. Controlling Access to Files (Tasks)
- Using UNIX Permissions to Protect Files
- Using Access Control Lists to Protect UFS Files
- Protecting Executable Files From Compromising Security
- Protecting Files (Tasks)
- Protecting Files With UNIX Permissions (Task Map)
- How to Display File Information
- How to Change the Owner of a File
- How to Change Group Ownership of a File
- How to Change File Permissions in Symbolic Mode
- How to Change File Permissions in Absolute Mode
- How to Change Special File Permissions in Absolute Mode
- Protecting Against Programs With Security Risk (Task Map)
- How to Find Files With Special File Permissions
- How to Disable Programs From Using Executable Stacks
- 2. Managing Machine Security (Overview)
- Part III Roles, Rights Profiles, and Privileges
- 8. Using Roles and Privileges (Overview)
- Role-Based Access Control (Overview)
- RBAC: An Alternative to the Superuser Model
- RBAC Elements and Basic Concepts
- Privilege Escalation
- RBAC Authorizations
- Authorizations and Privileges
- Privileged Applications and RBAC
- RBAC Rights Profiles
- RBAC Roles
- Profile Shells and RBAC
- Name Service Scope and RBAC
- Security Considerations When Directly Assigning Security Attributes
- Usability Considerations When Directly Assigning Security Attributes
- Privileges (Overview)
- About RBAC in This Release
- Role-Based Access Control (Overview)
- 9. Using Role-Based Access Control (Tasks)
- Using RBAC (Tasks)
- Viewing and Using RBAC Defaults (Tasks)
- Customizing RBAC for Your Site (Tasks)
- Initially Configuring RBAC (Task Map)
- How to Plan Your RBAC Implementation
- How to Create a Role
- How to Assign a Role
- How to Audit Roles
- How to Create a Rights Profile
- How to Clone and Modify a System Rights Profile
- How to Create an Authorization
- How to Add RBAC Properties to Legacy Applications
- How to Troubleshoot RBAC and Privilege Assignment
- Managing RBAC (Tasks)
- Managing RBAC (Task Map)
- How to Change the Password of a Role
- How to Change the Security Attributes of a Role
- How to Reorder Assigned Security Attributes
- How to Restrict an Administrator to Explicitly Assigned Rights
- How to Enable a User to Use Own Password to Assume a Role
- How to Change the root Role Into a User
- Using Privileges (Tasks)
- How to List the Privileges on the System
- How to Determine the Privileges That You Have Been Directly Assigned
- How to Determine the Privileged Commands That You Can Run
- How to Determine the Privileges on a Process
- How to Determine Which Privileges a Program Requires
- How to Apply Extended Privilege Policy to a Port
- How to Run a Shell Script With Privileged Commands
- 10. Security Attributes in Oracle Solaris (Reference)
- 8. Using Roles and Privileges (Overview)
- Part IV Cryptographic Services
- 11. Cryptographic Framework (Overview)
- 12. Cryptographic Framework (Tasks)
- Protecting Files With the Cryptographic Framework (Tasks)
- Administering the Cryptographic Framework (Tasks)
- Administering the Cryptographic Framework (Task Map)
- How to List Available Providers
- How to Add a Software Provider
- How to Use the Cryptographic Framework in FIPS-140 Mode
- How to Prevent the Use of a User-Level Mechanism
- How to Prevent the Use of a Kernel Software Provider
- How to List Hardware Providers
- How to Disable Hardware Provider Mechanisms and Features
- How to Refresh or Restart All Cryptographic Services
- 13. Key Management Framework
- Managing Public Key Technologies (Overview)
- Using the Key Management Framework (Tasks)
- Using the Key Management Framework (Task Map)
- How to Create a Certificate by Using the pktool gencert Command
- How to Import a Certificate Into Your Keystore
- How to Export a Certificate and Private Key in PKCS #12 Format
- How to Generate a Passphrase by Using the pktool setpin Command
- How to Generate a Key Pair by Using the pktool genkeypair Command
- How to Sign a Certificate Request by Using the pktool signcsr Command
- How to Manage Third-Party Plugins in KMF
- Part V Authentication Services and Secure Communication
- 14. Using Pluggable Authentication Modules
- 15. Using Secure Shell
- Secure Shell (Overview)
- Secure Shell and the OpenSSH Project
- Secure Shell and FIPS-140
- Configuring Secure Shell (Tasks)
- Using Secure Shell (Tasks)
- Using Secure Shell (Task Map)
- How to Generate a Public/Private Key Pair for Use With Secure Shell
- How to Change the Passphrase for a Secure Shell Private Key
- How to Log In to a Remote Host With Secure Shell
- How to Reduce Password Prompts in Secure Shell
- How to Remotely Administer ZFS With Secure Shell
- How to Use Port Forwarding in Secure Shell
- How to Copy Files With Secure Shell
- How to Set Up Default Secure Shell Connections to Hosts Outside a Firewall
- 16. Secure Shell (Reference)
- 17. Using Simple Authentication and Security Layer
- 18. Network Services Authentication (Tasks)
- Overview of Secure RPC
- NFS Services and Secure RPC
- Kerberos Authentication
- DES Encryption With Secure NFS
- Diffie-Hellman Authentication and Secure RPC
- Implementation of Diffie-Hellman Authentication
- Generating the Public Keys and Secret Keys for Secure RPC
- Running the keylogin Command for Secure RPC
- Generating the Conversation Key for Secure RPC
- Initially Contacting the Server in Secure RPC
- Decrypting the Conversation Key in Secure RPC
- Storing Information on the Server in Secure RPC
- Returning the Verifier to the Client in Secure RPC
- Authenticating the Server in Secure RPC
- Handling Transactions in Secure RPC
- Implementation of Diffie-Hellman Authentication
- Administering Authentication With Secure RPC (Tasks)
- Overview of Secure RPC
- Part VI Kerberos Service
- 19. Introduction to the Kerberos Service
- 20. Planning for the Kerberos Service
- Why Plan for Kerberos Deployments?
- Planning Kerberos Realms
- Mapping Host Names Onto Realms
- Client and Service Principal Names
- Ports for the KDC and Admin Services
- The Number of Slave KDCs
- Mapping GSS Credentials to UNIX Credentials
- Automatic User Migration to a Kerberos Realm
- Which Database Propagation System to Use
- Clock Synchronization Within a Realm
- Client Configuration Options
- Improving Client Login Security
- KDC Configuration Options
- Trusts of Services for Delegation
- Kerberos Encryption Types
- Online Help URL in the Graphical Kerberos Administration Tool
- 21. Configuring the Kerberos Service (Tasks)
- Configuring the Kerberos Service (Task Map)
- Configuring Additional Kerberos Services (Task Map)
- Configuring KDC Servers
- How to Automatically Configure a Master KDC
- How to Interactively Configure a Master KDC
- How to Manually Configure a Master KDC
- How to Configure a KDC to Use an LDAP Data Server
- How to Automatically Configure a Slave KDC
- How to Interactively Configure a Slave KDC
- How to Manually Configure a Slave KDC
- How to Refresh the Ticket-Granting Service Keys on a Master Server
- Configuring Cross-Realm Authentication
- Configuring Kerberos Network Application Servers
- Configuring Kerberos NFS Servers
- Configuring Kerberos Clients
- Configuring Kerberos Clients (Task Map)
- How to Create a Kerberos Client Installation Profile
- How to Automatically Configure a Kerberos Client
- How to Interactively Configure a Kerberos Client
- How to Configure a Kerberos Client for an Active Directory Server
- How to Manually Configure a Kerberos Client
- How to Disable Verification of the Ticket-Granting Ticket
- How to Access a Kerberos Protected NFS File System as the root User
- How to Configure Automatic Migration of Users in a Kerberos Realm
- How to Configure Account Lockout
- How to Automatically Renew All Ticket-Granting Tickets (TGTs)
- Synchronizing Clocks Between KDCs and Kerberos Clients
- Swapping a Master KDC and a Slave KDC
- Administering the Kerberos Database
- Backing Up and Propagating the Kerberos Database
- How to Back Up the Kerberos Database
- How to Restore the Kerberos Database
- How to Convert a Kerberos Database After a Server Upgrade
- How to Reconfigure a Master KDC to Use Incremental Propagation
- How to Reconfigure a Slave KDC to Use Incremental Propagation
- How to Configure a Slave KDC to Use Full Propagation
- How to Verify That the KDC Servers Are Synchronized
- How to Manually Propagate the Kerberos Database to the Slave KDCs
- Setting Up Parallel Propagation
- Configuration Steps for Setting Up Parallel Propagation
- Administering the Stash File
- How to Remove a Stash File
- How to Employ a New Master Key
- Managing a KDC on an LDAP Directory Server
- Increasing Security on Kerberos Servers
- 22. Kerberos Error Messages and Troubleshooting
- 23. Administering Kerberos Principals and Policies (Tasks)
- Ways to Administer Kerberos Principals and Policies
- SEAM Tool
- Administering Kerberos Principals
- Administering Kerberos Principals (Task Map)
- Automating the Creation of New Kerberos Principals
- How to View the List of Kerberos Principals
- How to View a Kerberos Principal's Attributes
- How to Create a New Kerberos Principal
- How to Duplicate a Kerberos Principal
- How to Modify a Kerberos Principal
- How to Delete a Kerberos Principal
- How to Set Up Defaults for Creating New Kerberos Principals
- How to Modify the Kerberos Administration Privileges
- Administering Kerberos Policies
- SEAM Tool Reference
- Administering Keytab Files
- 24. Using Kerberos Applications (Tasks)
- 25. The Kerberos Service (Reference)
- Kerberos Files
- Kerberos Commands
- Kerberos Daemons
- Kerberos Terminology
- How the Kerberos Authentication System Works
- How the Kerberos Service Interacts With DNS and the nsswitch Service
- Gaining Access to a Service Using Kerberos
- Using Kerberos Encryption Types
- Using the gsscred Table
- Notable Differences Between Oracle Solaris Kerberos and MIT Kerberos
- Part VII Auditing in Oracle Solaris
- 26. Auditing (Overview)
- 27. Planning for Auditing
- 28. Managing Auditing (Tasks)
- Configuring the Audit Service (Tasks)
- Configuring the Audit Service (Task Map)
- How to Display Audit Service Defaults
- How to Preselect Audit Classes
- How to Configure a User's Audit Characteristics
- How to Change Audit Policy
- How to Change Audit Queue Controls
- How to Configure the audit_warn Email Alias
- How to Add an Audit Class
- How to Change an Audit Event's Class Membership
- Configuring Audit Logs (Tasks)
- Configuring the Audit Service in Zones (Tasks)
- Enabling and Disabling the Audit Service (Tasks)
- Managing Audit Records on Local Systems (Tasks)
- Managing Audit Records on Local Systems (Task Map)
- How to Display Audit Record Definitions
- How to Merge Audit Files From the Audit Trail
- How to Select Audit Events From the Audit Trail
- How to View the Contents of Binary Audit Files
- How to Clean Up a not_terminated Audit File
- How to Prevent Audit Trail Overflow
- Troubleshooting the Audit Service (Tasks)
- Troubleshooting the Audit Service (Task Map)
- How to Determine That Auditing Is Running
- How to Lessen the Volume of Audit Records That Are Produced
- How to Audit All Commands by Users
- How to Find Audit Records of Changes to Specific Files
- How to Update the Preselection Mask of Logged In Users
- How to Prevent the Auditing of Specific Events
- How to Limit the Size of Binary Audit Files
- How to Compress Audit Files on a Dedicated File System
- How to Audit Logins From Other Operating Systems
- How to Audit FTP and SFTP File Transfers
- Configuring the Audit Service (Tasks)
- 29. Auditing (Reference)
- Audit Service
- Audit Service Man Pages
- Rights Profiles for Administering Auditing
- Auditing and Oracle Solaris Zones
- Audit Configuration Files and Packaging
- Audit Classes
- Audit Plugins
- Audit Remote Server
- Audit Policy
- Process Audit Characteristics
- Audit Trail
- Conventions for Binary Audit File Names
- Audit Record Structure
- Audit Token Formats
- acl Token
- argument Token
- attribute Token
- cmd Token
- exec_args Token
- exec_env Token
- file Token
- fmri Token
- group Token
- header Token
- ip address Token
- ip port Token
- ipc Token
- IPC_perm Token
- path Token
- path_attr Token
- privilege Token
- process Token
- return Token
- sequence Token
- socket Token
- subject Token
- text Token
- trailer Token
- use of authorization Token
- use of privilege Token
- user Token
- xclient Token
- zonename Token
- Glossary
- Index