Administering Solaris Trusted Extensions (SC-326-S10)

Please note that Oracle courses running at London training centres are subject to a 10% surcharge.

Overview

The Adminstering Solaris Trusted Extensions course focuses on features that enhance system security, such as auditing, controlling access to removable media devices, and managing local and remote file systems. Other topics include configuring labeled networking and labeled printing, setting up LDAP on Trusted Extensions, and migrating from Trusted Solaris 8 to Solaris Trusted Extensions.The Administering Solaris Trusted Extensions course provides students with the knowledge required to perform advanced administration of a Solaris Trusted Extensions system. Students learn to compartmentalize system administrator powers through the use of privileges, authorizations, and roles, and then to restrict the capabilities of the users.

Who Can Benefit
Students who can benefit from this course are system administrators and security administrators who are responsible for managing labeled systems. Systems integrators and designers of classified government systems or commercial systems with high-security data protection needs can also benefit from this course.

Prerequisites

• Administer Solaris 10 OS platform systems
• Display an understanding of data separation requirements in high-security environments
• Perform basic Solaris network configuration tasks
• Configure Solaris 10 system features such as zones and file systems

Recommended prerequisite courses include:

• Solaris 10 Features for Experienced Solaris System Administrators (SA-225-S10)
• Solaris 10 ZFS Administration (SA-229-S10)
• Solaris 10 Containers (SA-230-S10)

Delegates will learn how to

• Apply the principle of least privilege to processes and users, and use privileges to grant additional rights to processes
• Use authorizations to grant additional rights to users
• Use the Service Management Facility to configure Solaris Trusted Extensions services
• Configure the auditing system to audit user and kernel activity
• Configure networking between Solaris Trusted Extensions systems and other labeled and unlabeled systems
• Configure NFS and LOFS file system types in a labeled environment
• Set up multilevel labeled printers and configure removable media devices such as tape drives
• Set up an LDAP server and an LDAP proxy on a Solaris Trusted Extensions system
• Determine a migration path from Trusted Solaris 8 to Solaris Trusted Extensions
• Install third-party applications on Solaris Trusted Extensions

Course outline

Module 1 – Configure Privileges, Authorizations, Rights Profiles, and Roles

• Describe the Solaris Trusted Extensions privileges
• Use privileges to limit the process rights
• Configure the privileges sets of labeled zones
• Create administrative roles to reduce the need for a superuser
• Describe the Solaris Trusted Extensions authorizations
• Grant authorizations to administrative accounts
• Describe the differences in the RBAC configuration files between the basic Solaris 10 Operating System and Solaris Trusted Extensions

Module 2 – Perform Service Management in Solaris Trusted Extensions

• Configure services in the global zone
• Configure services in the labeled zones
• Limit services in labeled zones for security reasons
• Describe services that are specific to Solaris Trusted Extensions

Module 3 – Device Allocation

• Describe the security risks of removable-media devices
• Grant users authorization to allocate removable-media devices
• Add and configure additional devices to a Solaris Trusted Extensions TX system
• Restrict access to individual devices to within specified label ranges

Module 4 – Auditing a Solaris Trusted Extensions (TX) System

• Review Solaris auditing
• Describe the audit configuration files
• Configure the audit system to collect system usage data
• Describe the additional Solaris Trusted Extensions audit events
• Enable and disable the audit function
• Search and examine the audit records

Module 5 – Networking Solaris Trusted Extensions Systems

• Describe the CIPSO network labeling protocol
• Describe how the Mandatory Access Control (MAC) rules apply to network communications
• Configure Solaris Trusted Extensions to communicate with other labeled systems
• Configure Solaris Trusted Extensions to communicate with unlabeled systems
• Set up multilevel ports
• Administer the Solaris Trusted Extensions network configuration files
• Configure routing
• Configure networking between labeled zones and the global zone
• Configure Solaris Trusted Extensions network interfaces
• Grant and restrict access to the global zone from the network

Module 6 – NFS and LOFS File Systems

• Share file systems from labeled zones using NFS
• Mount NFS file systems from labeled and unlabeled NFS servers
• Configure NFS-mounted home directories for users
• Use the loopback filesystem (LOFS) in labeled zones to mount files from the global zone
• Configure the automounter in labeled zones

Module 7 – Solaris Trusted Extensions Printing

• Review Solaris 10 printer configuration
• Describe the security concerns of having printers available from labeled systems
• Describe how Mandatory Access Controls and labels apply to printers and printed output
• Utilize the Solaris Trusted Extensions modified printer management commands
• Configure single-level and multilevel printers
• Configure reduced restrictions on Solaris Trusted Extensions printers
• Customize printer output

Module 8 – Configuring LDAP

• Install the Sun Directory Server (LDAP) on a Solaris Trusted Extensions system
• Populate the LDAP server with data
• Configure SMC to use LDAP
• Configure the Solaris Trusted Extensions LDAP proxy

Module 9 – Migrating From Trusted Solaris 8 to Solaris Trusted Extensions

• Describe the differences between Trusted Solaris 8 and Solaris Trusted Extensions
• Configure Solaris Trusted Extensions systems to communicate with Trusted Solaris 8 systems
• Transfer Trusted Solaris user files to Solaris Trusted Extensions while preserving labels

Module 10 – Installing Unbundled Applications

• Describe Mandatory Access Control and labeling issues with respect to unbundled applications
• Determine the requirements for unbundled applications on Solaris Trusted Extensions
• Assign privileges to applications as needed
• Install applications to run in the global zone or in labeled zones
• Review developer concepts and resources for Solaris Trusted Extensions programmin

Suggested follow-on courses:

• Personalizing Security on the Solaris 10 Operating System (SC-301-S10)
• Solaris Operating System Network Intrusion Detection (SC-345)
• Enterprise Intrusion Analysis (SC-375)
• Computer Security Forensics and System Recovery (SC-410)