Solaris Trusted Extensions Installation, Configuration
Total Page:16
File Type:pdf, Size:1020Kb
Solaris Trusted Extensions Installation, Configuration Student Guide - Volume I SC-327-S10 Rev B D61906GC10 Edition 1.0 2009 D62627 Copyright © 2009, Oracle and/or its affiliates. All rights reserved. Disclaimer This document contains proprietary information, is provided under a license agreement containing restrictions on use and disclosure, and is protected by copyright and other intellectual property laws. You may copy and print this document solely for your own use in an Oracle training course. The document may not be modified or altered in any way. Except as expressly permitted in your license agreement or allowed by law, you may not use, share, download, upload, copy, print, display, perform, reproduce, publish, license, post, transmit, or distribute this document in whole or in part without the express authorization of Oracle. The information contained in this document is subject to change without notice. If you find any problems in the document, please report them in writing to: Oracle University, 500 Oracle Parkway, Redwood Shores, California 94065 USA. This document is not warranted to be error-free. Sun Microsystems, Inc. Disclaimer This training manual may include references to materials, offerings, or products that were previously offered by Sun Microsystems, Inc. Certain materials, offerings, services, or products may no longer be offered or provided.Oracle and its affiliates cannot be held responsible for any such references should they appear in the text provided. Restricted Rights Notice If this documentation is delivered to the U.S. Government or anyone using the documentation on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS The U.S. Government’s rights to use, modify, reproduce, release, perform, display, or disclose these training materials are restricted by the terms of the applicable Oracle license agreement and/or the applicable U.S. Government contract. Trademark Notice Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This page intentionally left blank. This page intentionally left blank. Table of Contents About This Course .................................................................Preface-i Course Goals............................................................................... Preface-i How Prepared Are You?............................................................Preface-iii Introductions .............................................................................. Preface-iv How to Use Course Materials..................................................... Preface-v Conventions ............................................................................... Preface-vi Typographical Conventions............................................Preface-viii Additional Conventions .................................................... Preface-ix Trusted Extensions Features ..........................................................1-1 Objectives ............................................................................................ 1-1 Additional Resources............................................................................ 1-3 What is Trusted Extensions?................................................................. 1-4 Common Criteria Certification .................................................... 1-5 Compartmented Mode Workstation............................................. 1-8 What is Trusted Extensions? The Answer................................... 1-9 Mandatory Access Control ................................................................. 1-10 Using Labeled Zones for Data Protection........................................... 1-11 Global Zone ............................................................................... 1-11 Principle of Least Privilege................................................................. 1-12 Privileges ................................................................................... 1-12 Authorizations............................................................................ 1-13 User Accounts and Roles........................................................... 1-13 Label-Aware Services......................................................................... 1-16 Multilevel Desktops............................................................................ 1-17 Trusted Extensions Networking.......................................................... 1-18 Exchanging Network Data......................................................... 1-18 Multilevel Ports.......................................................................... 1-19 Mounting Files in Trusted Extensions................................................ 1-20 Controlling Access to Removable Media Devices ............................. 1-21 Multi-Level Printing ........................................................................... 1-22 Auditing .............................................................................................. 1-23 System Management Tools................................................................. 1-24 LDAP Naming Service ....................................................................... 1-25 vii Copyright 2009 Sun Microsystems, Inc. All Rights Reserved. Sun Services, Revision B Installing Solaris Trusted Extensions............................................ 2-1 Objectives ............................................................................................ 2-1 Additional Resources............................................................................ 2-3 Solaris 10 and Trusted Extensions........................................................ 2-4 Solaris Trusted Extensions System Requirements................................ 2-5 Hardware Requirements .............................................................. 2-5 Software Requirements................................................................ 2-6 Enabling Solaris Trusted Extensions .................................................... 2-8 Installation Process ...................................................................... 2-8 Solaris Trusted Extensions Changes......................................... 2-10 Disabling Solaris Trusted Extensions ................................................. 2-11 Exercise: Installing Solaris 10 Trusted Extensions............................. 2-14 Task 1 – Enable Solaris Trusted Extensions....................................... 2-15 Task 2 – Log in to a Solaris Trusted Extensions System.......... 2-16 Task 3 – Disable Unnecessary SMF Services .......................... 2-17 Exercise Summary .............................................................................. 2-18 Configuring Solaris Trusted Extensions ....................................... 3-1 Objectives ............................................................................................ 3-1 Additional Resources............................................................................ 3-3 Implementation Considerations ............................................................ 3-4 Site Security Policy...................................................................... 3-4 Data Types and Sensitivity Labels............................................... 3-5 Users and Their Clearances ......................................................... 3-6 Network Configuration Issues .............................................................. 3-7 Planning Your Network Configuration........................................ 3-7 Roles and the root Superuser............................................................ 3-18 Using the LDAP Naming Service....................................................... 3-19 Exercise: Configuring Solaris 10 Trusted Extensions ........................ 3-20 Task 1 – Installing a Site-Specific label_encodings File... 3-21 Task 2 – Examining the Global Zone ....................................... 3-24 Task 3 – Initializing the Solaris Management Console (SMC) 3-25 Task 4 – Configure Network Interfaces..................................... 3-27 Task 5 – Create and Configure Labeled Zones......................... 3-33 Task 6 – Create Roles and a User ............................................. 3-46 Task 7 – Create Role .profile Files ..................................... 3-50 Exercise Summary .............................................................................. 3-52 Access Controls............................................................................... 4-1 Objectives ............................................................................................ 4-1 Additional Resources............................................................................ 4-3 Discretionary Access Controls.............................................................. 4-4 DAC Permissions.................................................................................. 4-5 Basic File Permissions................................................................. 4-5 Basic Directory Permissions.......................................................