Controls access to the hardware, software, and other resources on a network
|
In the workplace, a number of machines that are connected to a server can be thought of as one large multifaceted system. You are responsible for the security of this larger system. You need to defend the network from outsiders who are trying to gain access to the network. You also need to ensure the integrity of the data on the machines within the network. Show
At the file level, the Solaris operating environment provides some standard security features that you can use to protect files, directories, and devices. At the system and network levels, the security issues are mostly the same. The first line of security defense is to control access to your system. You can control and monitor system access by doing the following:
Maintaining Physical SecurityTo control access to your system, you must maintain the physical security of your computing environment. For instance, a machine that is logged in and left unattended is vulnerable to unwanted access. An intruder can gain access to the operating system and to the network. The computer's surroundings and the computer hardware should be physically protected from unauthorized access. You can protect a SPARC machine from unwanted access to the hardware settings. Use the eeprom(1M) command to require a password to access the PROM. See How to Require a Password for Hardware Access for more information. Maintaining Login ControlYou also must prevent unauthorized logins to a system or the network, which you can do through password assignment and login control. All accounts on a system should have a password. A password is a simple authentication mechanism. An account without a password makes your entire network accessible to an intruder who guesses a user name. A strong password algorithm protects against brute force attacks. When a user logs in to a system, the login command consults the appropriate database according to the information that is listed in the /etc/nsswitch.conf file. This file can include the following entries:
For a description of the nsswitch.conf file, see the nsswitch.conf(4) man page. For information about naming or directory services, see the System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) or the System Administration Guide: Naming and Directory Services (FNS and NIS+). The login command verifies the user name and password that were entered. If the user name is not in the password file, the login command denies access to the machine. If the password is not correct for the user name that was entered, the login command denies access to the machine. When the user supplies a valid user name and its corresponding password, the system grants the user access to the machine. Sophisticated authentication and authorization mechanisms are available on Solaris systems. For a discussion of authentication and authorization mechanisms at the network level, see . Managing Password InformationWhen users log in to a system, the users must enter both a user name and a password. Although logins are publicly known, passwords must be kept secret. Passwords should be known only to each user. You should ask your users to choose their passwords carefully, and users should change their passwords often. Passwords are initially created when you set up a user account. To maintain security on user accounts, you can set up password aging to force users to routinely change their passwords. You can also disable a user account by locking the password. For detailed information about administering passwords, see “Managing User Accounts and Groups (Overview)” in System Administration Guide: Basic Administration and the passwd(1) man page. Local PasswordsIf your network uses /etc files, the password information is kept in the system's /etc/passwd and /etc/shadow files. The user name and other information are kept in the password file /etc/passwd, while the encrypted password itself is kept in a separate shadow file, /etc/shadow. This security measure prevents a user from gaining access to the encrypted passwords. While the /etc/passwd file is available to anyone who can log in to a machine, only superuser can read the /etc/shadow file. You can use the passwd command to change a user's password on a local system. NIS and NIS+ PasswordsIf your network uses NIS+, the password information is kept in the NIS+ database. Information in the NIS+ database can be protected by restricting access to authorized users. You can use the passwd command to change a user's password that is stored in a NIS+ database. If your network uses NIS, the password information is kept in the NIS password map. NIS does not support password aging. You can use the passwd command to change a user's password that is stored in the NIS password map. LDAP PasswordsThe Solaris LDAP Naming Service stores the password information and the shadow information in the ou=people container of the LDAP directory tree. On the Solaris LDAP naming service client, you can use the passwd –r ldap command to change a user's password. The LDAP naming service stores the password in the LDAP repository. In the Solaris 9 12/02 release, password policy is enforced on the SunTM Open Net Environment (Sun ONE) Directory Server. Specifically, the client's pam_ldap module obeys the password policy controls that are enforced on the Sun ONE Directory Server. For more information, see “LDAP Naming Services Security Model” in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP). Password EncryptionStrong password encryption provides an early barrier against attack. The Solaris 9 12/02 release provides four password encryption modules. The MD5 modules and the Blowfish module provide more robust password encryption than the UNIX algorithm. You specify the algorithms configuration for your site in the /etc/security/policy.conf file. In the policy.conf file, the algorithms are named by their identifier, as shown in the following table. Table 2–1 Password Encryption AlgorithmsIdentifier Description Algorithm Man Page 1 The MD5 algorithm that is compatible with MD5 algorithms on BSD and Linux systems. crypt_bsdmd5(5) 2a The Blowfish algorithm that is compatible with the Blowfish algorithm on BSD systems. crypt_bsdbf(5) md5 The Sun MD5 algorithm, which is considered stronger than the BSD and Linux version of MD5. crypt_sunmd5(5) __unix__ The traditional UNIX encryption algorithm. This algorithm is the default module in the policy.conf file. crypt_unix(5) Algorithms Configuration in the policy.conf FileThe following shows the default policy.conf file: # # Copyright 1999-2002 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # /etc/security/policy.conf # # security policy configuration for user attributes. see policy.conf(4) # #ident "@(#)policy.conf 1.6 02/06/07 SMI" # AUTHS_GRANTED=solaris.device.cdrw PROFS_GRANTED=Basic Solaris User # crypt(3c) Algorithms Configuration # # CRYPT_ALGORITHMS_ALLOW specifies the algorithms that are allowed to # be used for new passwords. This is enforced only in crypt_gensalt(3c). # CRYPT_ALGORITHMS_ALLOW=1,2a,md5 # To deprecate use of the traditional unix algorithm, uncomment below # and change CRYPT_DEFAULT= to another algorithm. For example, # CRYPT_DEFAULT=1 for BSD/Linux MD5. # #CRYPT_ALGORITHMS_DEPRECATE=__unix__ # The Solaris default is the traditional UNIX algorithm. This is not # listed in crypt.conf(4) since it is internal to libc. The reserved # name __unix__ is used to refer to it. # CRYPT_DEFAULT=__unix__ When you change the value for CRYPT_DEFAULT, the passwords of new users are encrypted with the algorithm that is associated with the new value. When current users change their passwords, how their old password was encrypted affects which algorithm is used to encrypt the new password. For example, assume that CRYPT_ALGORITHMS_ALLOW=1,2a,md5 and CRYPT_DEFAULT=1. The following table shows which algorithm would be used to generate the encrypted password. Initial Password Algorithm Changed Password Algorithm Explanation crypt_bsdmd5 crypt_bsdmd5 The identifier of crypt_bsdmd5 is 1, the value of CRYPT_DEFAULT. The user's password continues to be encrypted with the crypt_bsdmd5 algorithm. crypt_bsdbf crypt_bsdbf The identifier of crypt_bsdbf is 2a. Because 2a is in the CRYPT_ALGORITHMS_ALLOW list, the new password is encrypted with the crypt_bsbdf algorithm. crypt_md5 crypt_md5 The identifier of crypt_md5 is md5. Because md5 is in the CRYPT_ALGORITHMS_ALLOW list, the new password is encrypted with the crypt_md5 algorithm. crypt_unix crypt_bsdmd5 The identifier of crypt_unix is __unix__. The __unix__ identifier is not in the CRYPT_ALGORITHMS_ALLOW list. Therefore, the crypt_unix algorithm cannot be used. The new password is encrypted with the CRYPT_DEFAULT algorithm. For more information on the syntax for configuring the algorithm choices, see the policy.conf(4) man page. For information on how to use the new password encryption algorithms, see Changing the Default Algorithm for Password Encryption. Special System LoginsTwo common ways to access a system are by using a conventional user login, or by using the root login. In addition, a number of special system logins enable a user to perform administrative commands without using the root account. As system administrator, you assign passwords to these login accounts. The following table lists some system login accounts and their uses. The system logins perform special functions. Each login has its own group identifier number (GID). Each login should have its own password, which should be divulged on a need-to-know basis. Table 2–2 System LoginsLogin Account GID Use root 0 Has almost no restrictions. Overrides all other logins, protections, and permissions. The root account has access to the entire system. The password for the root login should be very carefully protected. The root account owns most of the Solaris commands. daemon 1 Controls background processing. bin 2 Owns some of the Solaris commands. sys 3 Owns many system files. adm 4 Owns certain administrative files. lp 71 Owns the object data files and spooled data files for the printer. uucp 5 Owns the object data files and spooled data files for UUCP, the UNIX-to-UNIX copy program. nuucp 9 Is used by remote systems to log in to the system and start file transfers. Remote LoginsRemote logins offer a tempting avenue for intruders. The Solaris operating environment provides a number of commands to monitor, limit, and disable remote logins. For procedures, see Securing Logins and Passwords. By default, remote logins cannot gain control or read certain system devices, such as the system mouse, keyboard, frame buffer or audio device. For more information, see the logindevperm(4) man page. Dial-up LoginsWhen a computer can be accessed through a modem or a dial-up port, you can add an extra layer of security. You can require a dial-up password for users who access a system through a modem or dial-up port. The dial-up password is an additional password that a user must enter before being granted access to the machine. Only superuser can create or change a dial-up password. To ensure the integrity of the system, the password should be changed about once a month. The most effective use of this feature is to require a dial-up password to gain access to a gateway system. For how to set up dial-up passwords, see How to Create a Dial-up Password. Two files are involved in creating a dial-up password, /etc/dialups and /etc/d_passwd. The dialups file contains a list of ports that require a dial-up password. The d_passwd file contains a list of shell programs that require an encrypted password as the additional dial-up password. The information in these two files is processed as follows:
|
