Setting Up the Global Zone in Trusted Extensions

Before setting up the global zone, you must make decisions about your configuration. For the decisions, see Collecting Information and Making Decisions Before Installing Trusted Extensions.

Task	Description	For Instructions
Protect the hardware.	Hardware can be protected by requiring a password to change hardware settings.	Controlling Access to System Hardware in System Administration Guide: Security Services
Configure labels.	Labels must be configured for your site. If you plan to use the default label_encodings file, you can skip this step.	Check and Install Your Label Encodings File
For IPv6, modify the /etc/system file.	If you are running an IPv6 network, you modify the /etc/system file to enable IP to recognize labeled packets.	Enable IPv6 Networking in Trusted Extensions
Create space for a Solaris ZFS snapshot.	If you plan to use a Solaris ZFS snapshot to clone zones, create the ZFS pool. ZFS is derived from and an acronym for “zettabyte file system”. Perform this task if you are going to clone the first zone to create the rest of the labeled zones.	Create ZFS Pool for Cloning Zones
Reboot and log in.	Upon login, you are in the global zone, which is an environment that recognizes and enforces mandatory access control (MAC).	Reboot and Log In to Trusted Extensions
Initialize the Solaris Management Console.	Trusted Extensions adds tools to the Solaris Management Console for administering users, roles, zones, and the network.	Initialize the Solaris Management Console Server in Trusted Extensions
Configure LDAP.	If you are using the LDAP naming service, set up the LDAP service.	Chapter 5, Configuring LDAP for Trusted Extensions (Tasks)
	If you have set up the LDAP service, make this system an LDAP client.	Make the Global Zone an LDAP Client in Trusted Extensions

Check and Install Your Label Encodings File

Your encodings file must be compatible with any Trusted Extensions host with which you are communicating.

---

Note - Trusted Extensions installs a default label_encodings file. This default file is useful for demonstrations. However, this file might not be a good choice for your use. If you plan to use the default file, you can skip this procedure.

---

• If you are familiar with encodings files, you can use the following procedure.

• If you are not familiar with encodings files, consult Solaris Trusted Extensions Label Administration for requirements, procedures, and examples.

---

Caution - You must successfully install labels before continuing, or the configuration will fail.

---

Before You Begin

As the security administrator, you have just added the Trusted Extensions packages, so you are already logged in.

The security administrator is responsible for editing, checking, and maintaining the label_encodings file. If you plan to edit the label_encodings file, make sure that the file itself is writable. For more information, see the label_encodings(4) man page.

1. Insert the media with the label_encodings file into the appropriate device.
2. Copy the label_encodings file to the disk.
3. Check the syntax of the new label encodings file.
   1. Open the Trusted_Extensions folder.

      Click mouse button 3 on the background.

   2. From the Workspace menu, choose Applications → Application Manager.
   3. Double-click the Trusted_Extensions folder icon.
      
4. Double-click the Check Encodings action.

   In the dialog box, type the full path name to the file:

   /full-pathname-of-label-encodings-file

   The chk_encodings command is invoked to check the syntax of the file. The results are displayed in the Check Encodings dialog box.

5. Read the contents of the Check Encodings dialog box.
6. Do one of the following:

   CONTINUE

   If the Check Encodings action reports no errors, you can continue. Go to Step 7.

   RESOLVE ERRORS

   If the Check Encodings action reports errors, the errors must be resolved before continuing. For assistance, see Chapter 3, Making a Label Encodings File (Tasks), in Solaris Trusted Extensions Label Administration.

7. If the file passes the syntax check, click Yes.

   The Check Encodings action creates a backup copy of the original file, then installs the checked version in /etc/security/tsol/label_encodings. The action then restarts the label daemon.

   ---

   Caution - Your label encodings file must pass the Check Encodings test before you continue.

   ---

Example 4-1 Checking label_encodings Syntax on the Command Line

In this example, the administrator tests several label_encodings files by using the command line.

# /usr/sbin/chk_encodings /var/encodings/label_encodings1
No errors found in /var/encodings/label_encodings1
# /usr/sbin/chk_encodings /var/encodings/label_encodings2
No errors found in /var/encodings/label_encodings2

When management decides to use the label_encodings2 file, the administrator runs a semantic analysis of the file.

# /usr/sbin/chk_encodings -a /var/encodings/label_encodings2
No errors found in /var/encodings/label_encodings2

---> VERSION = MYCOMPANY LABEL ENCODINGS  2.0 10/10/2006

---> CLASSIFICATIONS <---

   Classification 1: PUBLIC
   Initial Compartment bits: 10
   Initial Markings bits: NONE

---> COMPARTENTS AND MARKINGS USAGE ANALYSIS <---
...
---> SENSITIVITY LABEL to COLOR MAPPING <---
...

The administrator prints a copy of the semantic analysis for her records, then moves the file to the /etc/security/tsol directory.

# cp /var/encodings/label_encodings2 /etc/security/tsol/label.encodings.10.10.06

# cd /etc/security/tsol
# cp label_encodings label_encodings.tx.orig
# cp label.encodings.10.10.06 label_encodings

Finally, the administrator verifies that the label_encodings file is the company file.

# /usr/sbin/chk_encodings -a /etc/security/tsol/label_encodings | head -4
No errors found in /etc/security/tsol/label_encodings

---> VERSION = MYCOMPANY LABEL ENCODINGS  2.0 10/10/2006

Enable IPv6 Networking in Trusted Extensions

When IPv6 is disabled, Trusted Extensions cannot forward IPv6 packets with CIPSO options. To enable an IPv6 network in Trusted Extensions, you must add an entry in the /etc/system file.

• Type the following entry into the /etc/system file:

  set ip:ip6opt_ls = 0x0a

Troubleshooting

• If error messages during boot indicate that your IPv6 configuration is incorrect, correct the entry:

  • Check that the entry is spelled correctly.

  • Check that the system has been rebooted after adding the correct entry to the /etc/system file.

• If you install Trusted Extensions on a Solaris system that currently has IPv6 enabled, but you fail to add the IP entry in /etc/system, you see the following error message: t_optmgmt: System error: Cannot assign requested address time-stamp

• If you install Trusted Extensions on a Solaris system that does not have IPv6 enabled, and you fail to add the IP entry in /etc/system, you see the following types of error messages:

  • WARNING: IPv6 not enabled via /etc/system

  • Failed to configure IPv6 interface(s): hme0

  • rpcbind: Unable to join IPv6 multicast group for rpc broadcast broadcast-number

Create ZFS Pool for Cloning Zones

If you plan to use a Solaris ZFS snapshot as your zone template, you need to create a ZFS pool from a ZFS file or a ZFS device. This pool holds the snapshot for cloning each zone. You use the /zone device for your ZFS pool.

Before You Begin

You have set aside disk space during Solaris installation for a ZFS file system. For details, see Planning for Zones in Trusted Extensions.

1. Unmount the /zone partition.

   During installation, you created a /zone partition with sufficient disk space of about 2000 MBytes.

   # umount /zone

2. Remove the /zone mount point.

   # rmdir /zone

3. Comment out the /zone entry in the vfstab file.
   1. Prevent the /zone entry from being read.

      Open the vfstab file in an editor. Prefix the /zone entry with a comment sign.

      #/dev/dsk/cntndnsn  /dev/dsk/cntndnsn  /zone  ufs  2  yes  -

   2. Copy the disk slice, cntndnsn, to the clipboard.
   3. Save the file, and close the editor.
4. Use the disk slice to re-create /zone as a ZFS pool.

   # zpool create -f zone cntndnsn

   For example, if your /zone entry used disk slice c0t0d0s5, then the command would be the following:

   # zpool create -f zone c0t0d0s5

5. Verify that the ZFS pool is healthy.

   Use one of the following commands:

   # zpool status -x zone
   pool 'zone' is healthy

   # zpool list
   NAME     SIZE     USED   AVAIL   CAP   HEALTH   ALTROOT
   /zone    5.84G   80K    5.84G    7%   ONLINE   -

   In this example, the install team reserved a 6000MByte partition for zones. For more information, see the zpool(1M) man page.

Reboot and Log In to Trusted Extensions

At most sites, two or more administrators, who serve as an install team, are present when configuring the system.

Before You Begin

Before you first log in, become familiar with the desktop and label options in Trusted Extensions. For details, see Chapter 2, Logging In to Trusted Extensions (Tasks), in Solaris Trusted Extensions User’s Guide.

1. Reboot the system.

   # /usr/sbin/reboot

   If your system does not have a graphical display, go to Chapter 6, Configuring a Headless System With Trusted Extensions (Tasks).

2. Log in to the Solaris Trusted Extensions (CDE) desktop as superuser.
   1. In the login window, select Solaris Trusted Extensions (CDE) as the desktop.

      This Trusted CDE desktop contains actions that are useful when configuring the system.

   2. In the login dialog box, type root and the root password.

      Users must not disclose their passwords to another person, as that person might then have access to the data of the user and will not be uniquely identified or accountable. Note that disclosure can be direct, through the user deliberately disclosing his/her password to another person, or indirect, such as through writing it down, or choosing an insecure password. Trusted Extensions software provides protection against insecure passwords, but cannot prevent a user disclosing his/her password or writing it down.

3. Read the information in the Last Login dialog box.
   

   Then click OK to dismiss the box.

4. Read the Label Builder.

   Click OK to accept the default label.

   Once the login process is complete, the Trusted Extensions screen appears briefly, and you are in a desktop session with four workspaces. The Trusted Path symbol is displayed in the trusted stripe.

   ---

   Note - You must log off or lock the screen before leaving a system unattended. Otherwise, a person can access the system without having to pass identification and authentication, and that person would not be uniquely identified or accountable.

   ---

Initialize the Solaris Management Console Server in Trusted Extensions

This procedure enables you to administer users, roles, hosts, zones, and the network on this system. On the first system that you configure, only the files scope is available.

Before You Begin

You must be superuser.

1. Start the Solaris Management Console.

   # /usr/sbin/smc &

   ---

   Note - The first time the Solaris Management Console is started, it performs several registration tasks. These tasks can take a few minutes.

   ---

2. Do one of the following if toolbox icons do not appear in the Solaris Management Console:
   • If the Navigation pane is not visible:
     1. In the Open Toolbox dialog box that is displayed, click Load next to this system's name under Server.

        If this system does not have the recommended amount of memory and swap, it might take a few minutes for the toolboxes to display. For recommendations, see Installing or Upgrading the Solaris OS for Trusted Extensions.

     2. From the list of toolboxes, select a toolbox whose Policy=TSOL.

        Figure 4-1 shows a This Computer (this-host: Scope=Files, Policy=TSOL) toolbox. Trusted Extensions modifies tools under the System Configuration node.

        ---

        Caution - Do not choose a toolbox that has no policy. Toolboxes without a listed policy do not support Trusted Extensions.

        ---

        Your toolbox choice depends on which scope you want to influence.

        • To edit local files, choose the Files scope.

        • To edit LDAP databases, choose the LDAP scope.

          After you complete Edit the LDAP Toolbox in the Solaris Management Console, the LDAP scope is available.

     3. Click Open.
   • If the Navigation pane is visible, but the toolbox icons are stop signs:
     1. Exit the Solaris Management Console.
     2. Restart the Solaris Management Console.

        # /usr/sbin/smc &

3. If you have not yet done so, select a toolbox whose Policy=TSOL.

   The following figure shows a This Computer (this-host: Scope=Files, Policy=TSOL) toolbox. Trusted Extensions modifies tools under the System Configuration node.

   Figure 4-1 Trusted Extensions Tools in the Solaris Management Console

   
4. (Optional) Save the current toolbox.

   Saving a Policy=TSOL toolbox enables a Trusted Extensions toolbox to load by default. Preferences are saved per role, per host. The host is the Solaris Management Console server.

   1. From the Console menu, choose Preferences.

      The Home toolbox is selected.

   2. Define a Policy=TSOL toolbox as the Home toolbox.

      Put the current toolbox in the Location field by clicking the Use Current Toolbox button.

   3. Click OK to save the preferences.
5. Exit the Solaris Management Console.

See Also

For an overview of the Trusted Extensions additions to the Solaris Management Console, see Solaris Management Console Tools in Solaris Trusted Extensions Administrator’s Procedures. To use the Solaris Management Console to create security templates, see Configuring Trusted Network Databases (Task Map) in Solaris Trusted Extensions Administrator’s Procedures.

Make the Global Zone an LDAP Client in Trusted Extensions

For LDAP, this procedure establishes the naming service configuration for the global zone. If you are not using LDAP, you can skip this procedure.

Before You Begin

The Sun Java^TM System Directory Server, that is, the LDAP server, must exist. The server must be populated with Trusted Extensions databases, and this system must be able to contact the server. So, the system that you are configuring must have an entry in the tnrhdb database on the LDAP server, or this system must be included in a wildcard entry before you perform this procedure.

If an LDAP server that is configured with Trusted Extensions does not exist, you must complete the procedures in Chapter 5, Configuring LDAP for Trusted Extensions (Tasks) before you perform this procedure.

1. Save a copy of the original nsswitch.ldap file.

   The standard naming service switch file for LDAP is too restrictive for Trusted Extensions.

   # cd /etc
   # cp nsswitch.ldap nsswitch.ldap.orig

2. If you are using DNS, change the nsswitch.ldap file entries for the following services.

   The correct entries are similar to the following:

   hosts:    files dns ldap
   
   ipnodes:    files dns ldap
   
   networks:   ldap files
   protocols:  ldap files
   rpc:        ldap files
   ethers:     ldap files
   netmasks:   ldap files
   bootparams: ldap files
   publickey:  ldap files
   
   services:   files

   Note that Trusted Extensions adds two entries:

   tnrhtp:    files ldap
   tnrhdb:    files ldap

3. Copy the modified nsswitch.ldap file to nsswitch.conf.

   # cp nsswitch.ldap nsswitch.conf

4. In a Trusted CDE workspace, navigate to the Trusted_Extensions folder.
   1. Click mouse button 3 on the background.
   2. From the Workspace menu, choose Applications → Application Manager.
   3. Double-click the Trusted_Extensions folder icon.

      This folder contains actions that set up interfaces, LDAP clients, and labeled zones.

5. Double-click the Create LDAP Client action.

   Answer the following prompts:

   Domain Name:               Type the domain name
   Hostname of LDAP Server:   Type the name of the server
   IP Address of LDAP Server: Type the IP address
   LDAP Proxy Password:       Type the password to the server
   Profile Name:              Type the profile name

6. Click OK.

   The following completion message appears:

   global zone will be LDAP client of LDAP-server
   System successfully configured.
   
   *** Select Close or Exit from the window menu to close this window ***

7. Close the action window.
8. Verify that the information on the server is correct.
   1. Open a terminal window, and query the LDAP server.

      # ldapclient list

      The output looks similar to the following:

      NS_LDAP_FILE_VERSION= 2.0
      NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=domain-name
      ...
      NS_LDAP_BIND_TIME= number

   2. Correct any errors.

      If you get an error, run the Create LDAP Client action with the correct values. For example, the following error can indicate that the system does not have an entry on the LDAP server:

      LDAP ERROR (91): Can't connect to the LDAP server.
      Failed to find defaultSearchBase for domain domain-name

      To correct this error, you need to check the LDAP server.