»	Details below

 
 
 

Languages

English  

Who Can Benefit

Students who can benefit from this course are system administrators and security administrators who are responsible for managing labeled systems. Systems integrators and designers of classified government systems or commercial systems with high-security data protection needs can also benefit from this course.  

Prerequisites

To succeed fully in this course, students should be able to:

• Administer Solaris 10 OS platform systems
• Display an understanding of data separation requirements in high-security environments
• Perform basic Solaris network configuration tasks
• Configure Solaris 10 system features such as zones and file systems

 

Skills Gained

Upon completion of this course, students should be able to:

• Apply the principle of least privilege to processes and users, and use privileges to grant additional rights to processes
• Use authorizations to grant additional rights to users
• Use the Service Management Facility to configure Solaris Trusted Extensions services
• Configure the auditing system to audit user and kernel activity
• Configure networking between Solaris Trusted Extensions systems and other labeled and unlabeled systems
• Configure NFS and LOFS file system types in a labeled environment
• Set up multilevel labeled printers and configure removable media devices such as tape drives
• Set up an LDAP server and an LDAP proxy on a Solaris Trusted Extensions system
• Determine a migration path from Trusted Solaris 8 to Solaris Trusted Extensions
• Install third-party applications on Solaris Trusted Extensions

 

Related Courses

Before:

• Solaris 10 Features for Experienced Solaris System Administrators (SA-225-S10)
• Solaris 10 ZFS Administration (SA-229-S10)
• Solaris 10 Containers (SA-230-S10)

After:

• Configuring Security on the Solaris 10 Operating System (SC-301-S10)
• Solaris Operating System Network Intrusion Detection (SC-345)
• Enterprise Intrusion Analysis (SC-375)
• Computer Security Forensics and System Recovery (SC-410)

 

Course Content

Module 1 - Configure Privileges, Authorizations, Rights Profiles, and Roles

• Describe the Solaris Trusted Extensions privileges
• Use privileges to limit the process rights
• Configure the privileges sets of labeled zones
• Create administrative roles to reduce the need for a superuser
• Describe the Solaris Trusted Extensions authorizations
• Grant authorizations to administrative accounts
• Describe the differences in the RBAC configuration files between the basic Solaris 10 Operating System and Solaris Trusted Extensions

Module 2 - Perform Service Management in Solaris Trusted Extensions

• Configure services in the global zone
• Configure services in the labeled zones
• Limit services in labeled zones for security reasons
• Describe services that are specific to Solaris Trusted Extensions

Module 3 - Device Allocation

• Describe the security risks of removable-media devices
• Grant users authorization to allocate removable-media devices
• Add and configure additional devices to a Solaris Trusted Extensions TX system
• Restrict access to individual devices to within specified label ranges

Module 4 - Auditing a Solaris Trusted Extensions (TX) System

• Review Solaris auditing
• Describe the audit configuration files
• Configure the audit system to collect system usage data
• Describe the additional Solaris Trusted Extensions audit events
• Enable and disable the audit function
• Search and examine the audit records

Module 5 - Networking Solaris Trusted Extensions Systems

• Describe the CIPSO network labeling protocol
• Describe how the Mandatory Access Control (MAC) rules apply to network communications
• Configure Solaris Trusted Extensions to communicate with other labeled systems
• Configure Solaris Trusted Extensions to communicate with unlabeled systems
• Set up multilevel ports
• Administer the Solaris Trusted Extensions network configuration files
• Configure routing
• Configure networking between labeled zones and the global zone
• Configure Solaris Trusted Extensions network interfaces
• Grant and restrict access to the global zone from the network

Module 6 - NFS and LOFS File Systems

• Share file systems from labeled zones using NFS
• Mount NFS file systems from labeled and unlabeled NFS servers
• Configure NFS-mounted home directories for users
• Use the loopback filesystem (LOFS) in labeled zones to mount files from the global zone
• Configure the automounter in labeled zones

Module 7 - Solaris Trusted Extensions Printing

• Review Solaris 10 printer configuration
• Describe the security concerns of having printers available from labeled systems
• Describe how Mandatory Access Controls and labels apply to printers and printed output
• Utilize the Solaris Trusted Extensions modified printer management commands
• Configure single-level and multilevel printers
• Configure reduced restrictions on Solaris Trusted Extensions printers
• Customize printer output

Module 8 - Configuring LDAP

• Install the Sun Directory Server (LDAP) on a Solaris Trusted Extensions system
• Populate the LDAP server with data
• Configure SMC to use LDAP
• Configure the Solaris Trusted Extensions LDAP proxy

Module 9 - Migrating From Trusted Solaris 8 to Solaris Trusted Extensions

• Describe the differences between Trusted Solaris 8 and Solaris Trusted Extensions
• Configure Solaris Trusted Extensions systems to communicate with Trusted Solaris 8 systems
• Transfer Trusted Solaris user files to Solaris Trusted Extensions while preserving labels

Module 10 - Installing Unbundled Applications

• Describe Mandatory Access Control and labeling issues with respect to unbundled applications
• Determine the requirements for unbundled applications on Solaris Trusted Extensions
• Assign privileges to applications as needed
• Install applications to run in the global zone or in labeled zones
• Review developer concepts and resources for Solaris Trusted Extensions programming

 
Copyright 2004-2009 Sun Microsystems, Inc.