Administering Trusted Extensions Remotely (Task Map)
The following task map describes the tasks used to administer a remote
Trusted Extensions system.
How to Log In Remotely From the Command Line in Trusted Extensions
Note - The telnet command cannot be used for remote role assumption because this command
cannot pass the primary and role identities to the pam_roles module.
Before You Begin
The user and the role must be identically defined on the local
and the remote system.
The role must have the Remote Login authorization. By default, this authorization is
in the Remote Administration, and the Maintenance and Repair rights profiles.
The security administrator has completed the procedure Enable Remote Login by a Role in Trusted Extensions on every system that
can be remotely administered. If the system can be administered from an unlabeled system,
the procedure Enable Remote Login From an Unlabeled System has also been completed.
How to Remotely Administer Trusted Extensions With dtappsession
The dtappsession program enables an administrator to administer a remote system that is
running CDE.
dtappsession is useful when a remote system does not have a monitor. For
example, dtappsession is often used to administer domains on large servers. For more
information, see the dtappsession(1) man page.
Before You Begin
On a labeled system, you must be in an administrative role in
the global zone. On an unlabeled system, you must assume a role that
is defined on the remote system. You must then run the remote login
from the role's profile shell.
- (Optional) Create a workspace that is dedicated to the remote session.
To avoid confusion between the remote CDE applications and any local applications, dedicate
an administrative role workspace to this procedure. For details, see How to Add a Workspace at a Particular Label in Solaris Trusted Extensions User’s Guide.
- Log in to the remote host.
You can use the rlogin command or the ssh command.
$ ssh remote-host
- Start remote administration.
In the terminal window, type the dtappsession command followed by the name of
the local host.
$ /usr/dt/bin/dtappsession local-host
the Application Manager that is running on the remote host displays on the
local host. Also, an Exit dialog box appears.
- Administer the remote host.
If you invoked the remote session from Trusted CDE, you can use actions
in the Trusted_Extensions folder.
- When finished, click the Exit button.
Caution - Closing the Application Manager does not end the login session and is not
recommended.
- In the terminal window, exit the remote login session.
And use the hostname command to verify that you are on your local host.
$ exit
$ hostname
local-host
How to Remotely Administer Systems by Using the Solaris Management Console From a Trusted Extensions System
The Solaris Management Console provides a remote administration interface to manage users, rights,
roles, and the network. You assume a role to use the Console.
In this procedure, you run the Console on the local system and specify
the remote system as the server.
Before You Begin
You have completed the following procedures:
- On the local system, log in as the user who is defined
identically on the remote system.
- Assume the role that you plan to use to administer the system.
- In the role, start the Solaris Management Console.
For details, see Initialize the Solaris Management Console Server in Trusted Extensions.
- In the Server dialog box, type the name of the remote server.
- If you are using LDAP as a naming service, type the name
of the LDAP server.
Then, choose one of the following scopes.
- To administer the databases in the naming service, choose the Scope=LDAP toolbox.
This Computer (ldap-server: Scope=LDAP, Policy=TSOL)
- To administer the local files on the LDAP server, choose the Scope=Files
toolbox.
This Computer (ldap-server: Scope=Files, Policy=TSOL)
- If you are not using LDAP as a naming service, type the
name of the remote system that you want to administer.
Then, choose the Scope=Files toolbox.
This Computer (remote-system: Scope=Files, Policy=TSOL)
- Select a tool under System Configuration.
When you select a tool such as User, a dialog box displays the
Solaris Management Console server name, your user name, your role name, and a
place to type the role's password. Make sure that the entries are correct.
- In the role that is defined identically on the local and the
remote systems, log in to the Solaris Management Console server.
Type the role's password and press Login as Role. You can now use
the Solaris Management Console to manage the system.
Note - Although you can use the Solaris Management Console to run dtappsession, the simplest
way to use dtappsession is described in How to Remotely Administer Trusted Extensions With dtappsession.
How to Remotely Administer Systems by Using the Solaris Management Console From an Unlabeled System
In this procedure, you run the Solaris Management Console client and server
on the remote system, and display the Console on the local system.
Before You Begin
The Trusted Extensions system must have assigned the label ADMIN_LOW to the local
system.
Note - A system that is not running the CIPSO protocol, such as a
Trusted Solaris system, is an unlabeled system from the viewpoint of a Trusted
Extensions system.
The Solaris Management Console server on the remote system must be configured
to accept the remote connection. For the procedure, see Enable the Solaris Management Console to Accept Network Communications.
Both systems must have the same user who is assigned the same
role that can use the Solaris Management Console. The user can have the
normal user's label range, but the role must have the range from ADMIN_LOW
to ADMIN_HIGH.
You must be in an administrative role in the global zone.
- Enable the local X server to display the remote Solaris Management Console.
# xhost + TX-SMC-Server
# echo $DISPLAY
:n.n
- On the local system, become the user who can assume a role
for the Solaris Management Console.
# su - same-username-on-both-systems
- As that user, log in to the remote server as the role.
$ rlogin -l same-rolename-on-both-systems TX-SMC-Server
- Make sure that the environment variables that the Solaris Management Console uses
have the correct values.
- Set the value of the DISPLAY variable.
$ DISPLAY=local:n.n
$ export DISPLAY=local:n.n
- Set the value of the LOGNAME variable to the user name.
$ LOGNAME=same-username-on-both-systems
$ export LOGNAME=same-username-on-both-systems
- Set the value of the USER variable to the role name.
$ USER=same-rolename-on-both-systems
$ export USER=same-rolename-on-both-systems
- In the role, start the Solaris Management Console from the command line.
$ /usr/sbin/smc &
- Select a tool under System Configuration.
When you select a tool such as User, a dialog box displays the
Solaris Management Console server name, your user name, your role name, and a
place to type the role's password. Make sure that the entries are correct.
- As the role, log in to the server.
Type the role's password and press Login as Role. You can now use
the Solaris Management Console to manage the system.
Note - When you try to access network database information from a system that is
not the LDAP server, the operation fails. The Console allows you to log
in to the remote host and open the toolbox. However, when you try
to access or change information, the following error message indicates that you have
selected Scope=LDAP on a system that is not the LDAP server:
Management server cannot perform the operation requested.
...
Error extracting the value-from-tool.
The keys received from the client were machine, domain, Scope.
Problem with Scope.
How to Enable Specific Users to Log In Remotely to the Global Zone in Trusted Extensions
The user's default label range and the zone's default behavior are changed to
enable remote login by a non-role. You might want to complete this
procedure for a tester who is using a remote labeled system. For security
reasons, the tester's system should be running a disjoint label from other users.
Before You Begin
You must have a very good reason why this user can log
in to the global zone.
You must be in the Security Administrator role in the global zone.
- To enable specific users to log in to the global zone, assign them
an administrative label range.
Use the Solaris Management Console to assign a clearance of ADMIN_HIGH and a
minimum label of ADMIN_LOW to each user. For details, see How to Modify a User's Label Range in the Solaris Management Console.
The user's labeled zones must also permit login.
- To enable remote login from a labeled zone into the global zone, do
the following.
- Add a multilevel port for remote login to the global zone.
Use the Solaris Management Console. Port 513 over the TCP protocol enables
remote login. For an example, see How to Create a Multilevel Port for a Zone.
- Read the tnzonecfg changes into the kernel.
# tnctl -fz /etc/security/tsol/tnzonecfg
- Restart the remote login service.
# svcadm restart svc:/network/login:rlogin
How to Use Xvnc to Remotely Access a Trusted Extensions System
Virtual Network Computing (vnc) technology connects a client to a remote server, then
displays the desktop of the remote server in a window on the client.
Xvnc is the UNIX version of vnc, which is based on a
standard X server. In Trusted Extensions, a client on any platform can connect
to an Xvnc that is running Trusted Extensions software, log in to the
Xvnc server, then display and work on a multilevel desktop.
Before You Begin
You have installed and configured Trusted Extensions software on the system that is
going to be used as the Xvnc server. You have created and
booted the labeled zones. Your Xvnc server recognizes the vnc clients by hostname
or IP address.
You are superuser in the global zone of the system that is
going to be used as the Xvnc server.
- Configure the Xvnc server.
For more information, see the Xvnc(1) and vncconfig(1) man pages.
Caution - If you are running the Solaris 10 10/08 or the Solaris 10 5/08 release,
you must patch your system before configuring the server. For a SPARC system, install
the latest version of patch 125719. For an x86 system, install
the latest version of patch 125720.
- Create the Xservers configuration directory.
# mkdir -p /etc/dt/config
- Copy the /usr/dt/config/Xservers file to the /etc/dt/config directory.
# cp /usr/dt/config/Xservers /etc/dt/config/Xservers
- Edit the /etc/dt/config/Xservers file to start up the Xvnc program instead of Xserver
or Xorg.
In this example, the entry is configured to log in to the server
without a password. To successfully log in the desktop, the local UID must
be none instead of console.
The entry is split for display purposes. The entry must be on
one line.
# :0 Local local_uid@console root /usr/X11/bin/Xserver :0 -nobanner
:0 Local local_uid@none root /usr/X11/bin/Xvnc :0 -nobanner
-AlwaysShared -SecurityTypes None -geometry 1024x768x24 -depth 24
Note - A safer configuration is to require a password by using the -SecurityTypes VncAuth
parameter. The Xvnc(1) man page describes password requirements.
- Reboot the server or start the Xvnc server.
# reboot
After reboot, verify that the Xvnc program is running.
# ps -ef | grep Xvnc
root 2145 932 0 Jan 18 ? 6:15 /usr/X11/bin/Xvnc :0 -nobanner
-AlwaysShared -SecurityTypes None -geometry 1024
- On every vnc client of the Trusted Extensions Xvnc server, install vnc client
software.
For the client system, you have a choice of software. This example uses
the Sun vnc software.
# cd SUNW-pkg-directory
# pkgadd -d . SUNWvncviewer
- In a terminal window on a vnc client, connect to the server.
% /usr/bin/vncviewer Xvnc-server-hostname
- In the window that displays, type your name and password.
Continue with the login procedure. For a description of the remaining steps, see
Logging In to Trusted Extensions in Solaris Trusted Extensions User’s Guide.
If you logged in to the server as superuser, you can administer
the server immediately. If you logged in to the server as a user,
you must assume a role to administer the system.
