Solaris Trusted Extensions Installation, Configuration

Please note that Oracle courses running at London training centres are subject to a 10% surcharge.

Overview

Solaris Trusted Extensions Installation, Configuration and Administration provides students with the knowledge to install Solaris Trusted Extensions software onto a system running the Solaris 10 Operating System. The course presents students with how to design and configure the security label mechanisms, use extended security features of the two window managers Trusted CDE and Trusted JDS, and how to compartmentalize system administrator powers through the use of privileges, authorizations, and roles, and then to restrict the capabilities of the users. The course topics focus on features that enhance system security, such as auditing, controlling access to removable media devices, managing local and remote file systems, configuring labeled networking and labeled printing, setting up LDAP on Trusted Extensions, and migrating from Trusted Solaris 8 to Solaris Trusted Extensions.

Who Can Benefit
Students who can benefit from this course are system administrators and security administrators who are responsible for installing, configuring and managing labeled systems. Systems integrators and designers of classified government systems or commercial systems with high-security data protection needs will also benefit from this course. 

Prerequisites

To succeed in the course, students should be able to:

• Install the Solaris 10 operating system
• Administer Solaris 10 systems
• Display an understanding of data separation requirements in high-security environments
• Perform basic Solaris network configuration tasks
• Configure Solaris 10 system features such as zones and file systems
• Administer Solaris 10 OS platform systems
• Display an understanding of data separation requirements in high-security environments
• Perform basic Solaris network configuration tasks
• Configure Solaris 10 system features such as zones and file systems

Delegates will learn how to

• Install the Trusted Extensions package onto a Solaris 10 system
• Create and configure labeled zones
• Configure labeled networking in the labeled zones
• Login to Trusted Extensions and use the TX-specific features of the Trusted CDE and Trusted JDS window environments
• Design a security labeling scheme
• Implement a security labeling scheme with the label_encodings data base
• Apply the principle of least privilege to processes and users, and use privileges to grant additional rights to processes
• Use authorizations to grant additional rights to users
• Use the Service Management Facility to configure Solaris Trusted Extensions services
• Configure the auditing system to audit user and kernel activity
• Configure networking between Solaris Trusted Extensions systems and other labeled and unlabeled systems
• Configure NFS and LOFS file system types in a labeled environment
• Set up multilevel labeled printers and configure removable media devices such as tape drives
• Set up an LDAP server and an LDAP proxy on a Solaris Trusted Extensions system
• Determine a migration path from Trusted Solaris 8 to Solaris Trusted Extensions
• Install third-party applications on Solaris Trusted Extensions 

Course outline

 

Module 1 – Introducing Trusted Extensions Features

• Describe the history of Trusted Solaris and Trusted Extensions
• Describe the Common Criteria requirements
• Examine the importance of Mandatory Access Controls
• Describe the features of Trusted Extensions

Module 2 – Trusted Extensions Installation

• Understand the relationship between Trusted Extensions (TX) software and the Solaris 10 Operating System
• Determine the pre-installation implementation considerations
• Install the Trusted Extensions packages

Module 3 – Trusted Extensions Configuration

• Use the Solaris Management Console and other Trusted Extensions GUIs to configure TX options
• Configure the network options for TX systems
• Create labeled zones
• Create system and security administration roles
• Add users to assume roles

Module 4 – Access Controls

• Describe the differences between Discretionary Access Controls (DAC) and Mandatory Access Controls (MAC)
• Use Mandatory Access Control) components and features
• Use the Trusted Extensions commands for manipulating and displaying labels

Module 5 – User Interface Changes: Trusted CDE and TJDS

• Log into a TX system and use the CDE window manager
• Log into a TX system and use the TJDS window manager
• Understand how to change workspace labels
• Log into the Trusted Path (global zone)
• Understand the capabilities of the global zone versus the labeled zones
• Setup automatic dotfile creation

Module 6 – Configuring and Installing the label_encodings File

• Understand the purpose and uses of the label_encodings file
• Understand the required and optional sections of the label_encodings file
• Modify the label_encodings file to use your site labels, clearances and settings

Module 7 – Configure Privileges, Authorizations, Rights Profiles, and Roles

• Describe the Solaris Trusted Extensions privileges
• Use privileges to limit the process rights
• Configure the privileges sets of labeled zones
• Create administrative roles to reduce the need for a superuser
• Describe the Solaris Trusted Extensions authorizations
• Grant authorizations to administrative accounts
• Describe the differences in the RBAC configuration files between the basic Solaris 10 Operating System and Solaris Trusted Extensions

Module 8 – Perform Service Management in Solaris Trusted Extensions

• Configure services in the global zone
• Configure services in the labeled zones
• Limit services in labeled zones for security reasons
• Describe services that are specific to Solaris Trusted Extensions

Module 9 – Device Allocation

• Describe the security risks of removable-media devices
• Grant users authorization to allocate removable-media devices
• Add and configure additional devices to a Solaris Trusted Extensions TX system
• Restrict access to individual devices to within specified label ranges

Module 10 – Auditing a Solaris Trusted Extensions (TX) System

• Review Solaris auditing
• Describe the audit configuration files
• Configure the audit system to collect system usage data
• Describe the additional Solaris Trusted Extensions audit events
• Enable and disable the audit function
• Search and examine the audit records

Module 11 – Networking Solaris Trusted Extensions Systems

• Describe the CIPSO network labeling protocol
• Describe how the Mandatory Access Control (MAC) rules apply to network communications
• Configure Solaris Trusted Extensions to communicate with other labeled systems
• Configure Solaris Trusted Extensions to communicate with unlabeled systems
• Set up multilevel ports
• Administer the Solaris Trusted Extensions network configuration files
• Configure routing
• Configure networking between labeled zones and the global zone
• Configure Solaris Trusted Extensions network interfaces
• Grant and restrict access to the global zone from the network

Module 12 – NFS and LOFS File Systems

• Share file systems from labeled zones using NFS
• Mount NFS file systems from labeled and unlabeled NFS servers
• Configure NFS-mounted home directories for users
• Use the loopback filesystem (LOFS) in labeled zones to mount files from the global zone
• Configure the automounter in labeled zones

Module 13 – Solaris Trusted Extensions Printing

• Review Solaris 10 printer configuration
• Describe the security concerns of having printers available from labeled systems
• Describe how Mandatory Access Controls and labels apply to printers and printed output
• Utilize the Solaris Trusted Extensions modified printer management commands
• Configure single-level and multilevel printers
• Configure reduced restrictions on Solaris Trusted Extensions printers
• Customize printer output

Module 14 – Configuring LDAP

• Install the Sun Directory Server (LDAP) on a Solaris Trusted Extensions system
• Populate the LDAP server with data
• Configure SMC to use LDAP
• Configure the Solaris Trusted Extensions LDAP proxy

Module 15 – Migrating From Trusted Solaris 8 to Solaris Trusted Extensions

• Describe the differences between Trusted Solaris 8 and Solaris Trusted Extensions
• Configure Solaris Trusted Extensions systems to communicate with Trusted Solaris 8 systems
• Transfer Trusted Solaris user files to Solaris Trusted Extensions while preserving labels

Module 16 – Installing Unbundled Applications

• Describe Mandatory Access Control and labeling issues with respect to unbundled applications
• Determine the requirements for unbundled applications on Solaris Trusted Extensions
• Assign privileges to applications as needed
• Install applications to run in the global zone or in labeled zones
• Review developer concepts and resources for Solaris Trusted Extensions programming