System Administration Guide: Security Services Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A. Part No: 817–0365–10 August 2003 Copyright 2003 Sun Microsystems, Inc. 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. This product or document is protected by copyright and distributed under licenses restricting its use, copying, distribution, and decompilation. No part of this product or document may be reproduced in any form by any means without prior written authorization of Sun and its licensors, if any. Third-party software, including font technology, is copyrighted and licensed from Sun suppliers. Parts of the product may be derived from Berkeley BSD systems, licensed from the University of California. UNIX is a registered trademark in the U.S. and other countries, exclusively licensed through X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, docs.sun.com, AnswerBook, AnswerBook2, SunOS, Java, Sun ONE Directory Server, and Solaris are trademarks, registered trademarks, or service marks of Sun Microsystems, Inc. in the U.S. and other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the U.S. and other countries. Products bearing SPARC trademarks are based upon an architecture developed by Sun Microsystems, Inc. Xylogics product is protected by copyright and licensed to Sun by Xylogics. Xylogics and Annex are trademarks of Xylogics, Inc. Portions of the software copyright 1996 by the Massachusetts Institute of Technology. All rights reserved. The OPEN LOOK and Sun™ Graphical User Interface was developed by Sun Microsystems, Inc. for its users and licensees. Sun acknowledges the pioneering efforts of Xerox in researching and developing the concept of visual or graphical user interfaces for the computer industry. Sun holds a non-exclusive license from Xerox to the Xerox Graphical User Interface, which license also covers Sun’s licensees who implement OPEN LOOK GUIs and otherwise comply with Sun’s written license agreements. Federal Acquisitions: Commercial Software–Government Users Subject to Standard License Terms and Conditions. DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. Copyright 2003 Sun Microsystems, Inc. 4150 Network Circle, Santa Clara, CA 95054 U.S.A. Tous droits réservés. Ce produit ou document est protégé par un copyright et distribué avec des licences qui en restreignent l’utilisation, la copie, la distribution, et la décompilation. Aucune partie de ce produit ou document ne peut être reproduite sous aucune forme, par quelque moyen que ce soit, sans l’autorisation préalable et écrite de Sun et de ses bailleurs de licence, s’il y en a. Le logiciel détenu par des tiers, et qui comprend la technologie relative aux polices de caractères, est protégé par un copyright et licencié par des fournisseurs de Sun. Des parties de ce produit pourront être dérivées du système Berkeley BSD licenciés par l’Université de Californie. UNIX est une marque déposée aux Etats-Unis et dans d’autres pays et licenciée exclusivement par X/Open Company, Ltd. Sun, Sun Microsystems, le logo Sun, docs.sun.com, AnswerBook, AnswerBook2, SunOS, Java, Sun ONE Directory Server, et Solaris sont des marques de fabrique ou des marques déposées, ou marques de service, de Sun Microsystems, Inc. aux Etats-Unis et dans d’autres pays. Toutes les marques SPARC sont utilisées sous licence et sont des marques de fabrique ou des marques déposées de SPARC International, Inc. aux Etats-Unis et dans d’autres pays. Les produits portant les marques SPARC sont basés sur une architecture développée par Sun Microsystems, Inc. Xylogics Copyright 1996 des portions du logiciel par Massachusetts Institute of Technology. Tous droits réservés. L’interface d’utilisation graphique OPEN LOOK et Sun™ a été développée par Sun Microsystems, Inc. pour ses utilisateurs et licenciés. Sun reconnaît les efforts de pionniers de Xerox pour la recherche et le développement du concept des interfaces d’utilisation visuelle ou graphique pour l’industrie de l’informatique. Sun détient une licence non exclusive de Xerox sur l’interface d’utilisation graphique Xerox, cette licence couvrant également les licenciés de Sun qui mettent en place l’interface d’utilisation graphique OPEN LOOK et qui en outre se conforment aux licences écrites de Sun. CETTE PUBLICATION EST FOURNIE “EN L’ETAT” ET AUCUNE GARANTIE, EXPRESSE OU IMPLICITE, N’EST ACCORDEE, Y COMPRIS DES GARANTIES CONCERNANT LA VALEUR MARCHANDE, L’APTITUDE DE LA PUBLICATION A REPONDRE A UNE UTILISATION PARTICULIERE, OU LE FAIT QU’ELLE NE SOIT PAS CONTREFAISANTE DE PRODUIT DE TIERS. CE DENI DE GARANTIE NE S’APPLIQUERAIT PAS, DANS LA MESURE OU IL SERAIT TENU JURIDIQUEMENT NUL ET NON AVENU. 030312@5533 Contents Preface 17 Part I Security Overview 1 Security Services (Overview) 23 Introduction to Security Services 23 Machine Security 23 Authentication Services 24 Secure Communication 25 Auditing and Device Management 25 Part II Managing System Security 2 Managing Machine Security (Overview) 29 Controlling Access to a Computer System 29 Maintaining Physical Security 30 Maintaining Login Control 30 Controlling Access to Machine Resources 35 Limiting and Monitoring Superuser 36 Configuring Role-Based Access Control to Replace root 36 Preventing Unintentional Misuse of Machine Resources 36 Restricting setuid Executable Files 38 Using the Automated Security Enhancement Tool (ASET) 38 Using the Resource Manager 38 3 Monitoring Use of Machine Resources 38 Controlling Access to Files 39 Commands for File System Security 39 File Encryption 39 Access Control Lists (ACLs) 40 Sharing Files Across Machines 40 Restricting root Access to Shared Files 40 Controlling Network Access 41 Network Security Mechanisms 41 Authentication and Authorization for Remote Access 42 Firewall Systems 44 Reporting Security Problems 45 3 Securing Machines (Tasks) 47 Securing Machines (Task Map) 47 Securing Logins and Passwords 49 M How to Display a User’s Login Status 49 M How to Display Users Without Passwords 50 M How to Temporarily Disable User Logins 50 M How to Save Failed Login Attempts 51 M How to Create a Dial-up Password 52 M How to Temporarily Disable Dial-up Logins 53 Changing the Default Algorithm for Password Encryption 53 M How to Specify an Algorithm for Password Encryption 54 M How to Specify a New Password Algorithm for an NIS+ Domain 55 M How to Specify a New Password Algorithm for an NIS Domain 55 M How to Specify a New Password Algorithm for an LDAP Domain 55 M How to Install a Password Encryption Module From a Third Party 56 Monitoring and Restricting Superuser 57 M How to Monitor Who Is Using the su Command 57 M How to Display Superuser (root) Access Attempts to the Console 58 M How to Prevent Remote Login by Superuser (root)58 Securing the Hardware 59 M How to Require a Password for Hardware Access 59 M How to Disable or Enable a System’s Abort Sequence 60 4 System Administration Guide: Security Services • August 2003 4 Securing Files (Tasks) 61 File Security Features 61 User Classes 61 File Permissions 62 Directory Permissions 62 Special File Permissions (setuid, setgid and Sticky Bit) 63 Default umask Setting 64 Displaying File Information 65 M How to Display File Information 65 Changing File Ownership 67 M How to Change the Owner of a File 67 M How to Change Group Ownership of a File 68 Changing File Permissions 69 M How to Change Permissions in Absolute Mode 71 M How to Change Special Permissions in Absolute Mode 72 M How to Change Permissions in Symbolic Mode 73 Searching for Special Permissions 74 M How to Find Files With setuid Permissions 74 Executable Stacks and Security 75 M How to Disable Programs From Using Executable Stacks 76 M How to Disable Executable Stack Message Logging 76 Using Access Control Lists (ACLs) 76 ACL Entries for Files 77 ACL Entries for Directories 78 M How to Set an ACL on a File 79 M How to Copy an ACL 80 M How to Check If a File Has an ACL 81 M How to Modify ACL Entries on a File 81 M How to Delete ACL Entries From a File 82 M How to Display ACL Entries for a File 83 5 Role-Based Access Control (Overview) 85 RBAC: Replacing the Superuser Model 85 Solaris RBAC Elements 86 Privileged Applications 88 Applications That Check UIDs and GIDs 89 Applications That Check Authorizations 89 Contents 5 Profile Shell 89 RBAC Roles 90 RBAC Authorizations 90 RBAC Rights Profiles 91 Name Service Scope 91 6 Role-Based Access Control (Tasks) 93 Configuring RBAC (Task Map) 94 Planning for RBAC 94 M How to Plan Your RBAC Implementation 94 First-Time Use of the User Tool Collection 96 M How to Run the User Tool Collection 96 Setting Up Initial Users 97 M How to Create Initial Users by Using the User Accounts Tool 97 Setting Up Initial Roles 99 M How to Create the First Role (Primary Administrator) by Using the Administrative Roles Tool 99 Making Root a Role 101 M How to Make Root a Role 101 Managing RBAC Information (Task Map) 102 Using Privileged Applications 103 M How to Assume a Role at the Command Line 103 M How to Assume a Role in the Console Tools 104 Creating Roles 105 M How to Create a Role by Using the Administrative Roles Tool 105 M How to Create a Role From the Command Line 106 Changing Role Properties 108 M How to Change a Role by Using the Administrative