System Management Console Security Development Guide C120-E142-01EN

Transcription

1 System Management Console Security Development Guide C120-E142-01EN

2 Trademarks and Acknowledgement UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company Limited. Sun is a trademark or registered trademark of Sun Microsystems, Inc. of the United States (hereafter referred to as U. S. Sun Microsystems), registered in the United States and other countries. Solaris is a trademark of U. S. Sun Microsystems. All SPARC trademarks are trademarks or registered trademarks of SPARC International, Inc. of the United States, and they are licensed exclusively for use in the United States and other countries. Products bearing a SPARC trademark are based upon an architecture developed by U. S. Sun Microsystems. Other company and product names in this document are trademarks or registered trademarks of their respective companies. The contents of this manual shall not be reproduced in any way or form without the permission of Fujitsu Limited. All Rights Reserved, Copyright FUJITSU LIMITED 2001 C120-E142-01EN

3 Revision History (1/1) Edition Date Revised section (Added/Deleted/Altered) Details st edition An asterisk (*) indicates a section in the old edition. C120-E142-01EN

4

5 Preface With the spread of Internet use in recent years, companies have changed their approaches toward doing business, leading to businesses with Internet-associated activities changing to Internet-based businesses. Fujitsu has announced its business strategy as "Everything on the Internet," and intends to support the Internet-based businesses of its customers as well. Against this background, much attention has been given to security for each product in the PRIMEPOWER series. This manual provides information about products to be installed on a System Management Console (SMC) and its connection mode. The SMC is designed for status monitoring, acquiring log information, and specifying different settings for the main unit (PRIMEPOWER800/1000/2000 and GP7000F model 1000/2000). SMC installation and connection are implemented so that individual tasks can be performed. Such tasks include assuring security, such as by adopting security policies for users' organizations, network design, such as for the locations of firewalls, and setting up the nodes that make up the user system. This manual provides technical information and its contents are subject to change without prior notice. If the manual is found to contain any technically incorrect descriptions or typing errors, they will be corrected in the next revision. Intended Readers and Purpose of This Manual This manual is intended for the following readers: System administrators who use the System Management Console for the GP7000F model 1000/2000 and PRIMEPOWER800/1000/2000 Administrators for networks constructed and installed with the GP7000F model 1000/2000 and PRIMEPOWER800/1000/2000 The purpose of this manual is as follows: Supporting greater security in a system constructed and installed with the GP7000F model 1000/2000 and PRIMEPOWER800/1000/2000 Providing information for ensuring security during operation of the System Management Console with the GP7000F model 1000/2000 and PRIMEPOWER800/1000/2000 C120-E142-01EN i

6 Preface Applicable Products for This Manual This manual is applicable to the following products that operate in the Solaris7 and Solaris8 environments on the System Management Console with the GP7000F model 1000/2000 and PRIMEPOWER800/1000/2000: System Console Software SMC REMCS Agent ii C120-E142-01EN

7 Contents 1. Environment for SMC Operation Basic System Configuration and Functions of SMC for Use in a Network Assumed Operations Security Measures Handling Security Software Firewall/gateway support Solaris installation Package Configuration Package configuration of System Console Software Package configuration of SMC REMCS Agent rc scripts and daemons running on System Console Software/SMC REMCS Agent TCP/IP ports used by System Console Software/SMC REMCS Agent /etc/inet/inetd.conf used by System Console Software /etc/inet/service used by System Console Software Setting up cron for use with System Console Software /etc/dfs/dfstab used in System Console Software Routing Solaris OS Using the security patch of Solaris Assurance of account security Settings for Naming Service (NIS/NIS+) NTP settings Other security measures C120-E142-01EN iii

8 Contents 3. Preparing against Access of Partitioned OS Disconnecting the Management LAN Requirements for disconnection Restrictions resulting from disconnection Procedures for disconnection iv C120-E142-01EN

9 1. Environment for SMC Operation 1.1 Basic System Configuration and Functions of SMC for Use in a Network The following figure shows the basic system configuration for SMC installation. The SMC is installed within an intranet, and it is not directly connected to the Internet. The system control network is constructed as a dedicated network (System Management LAN). Service Service Firewall HUB Internet Intranet REMCS Center Partition#0 Console Connection Unit Partition#1 User (Administration LAN) Firewall Internet System Control Facility System Control LAN HUB System Management Consol HUB System administrator Connection to other device is prohibited NTP Server The following SMC functions are for network operation: Time synchronization NTP server referred to from each partition Time synchronization of System Control Facility Monitoring and maintenance Monitoring message notification to REMCS Center ( ) Firmware downloading from REMCS Center (http) Monitoring message notification to system administrator ( ) C120-E142-01EN 1-1

10 Environment for SMC Operation OS console window Console functions of each partition via the Console Connection Unit (RC2000) Power management Power schedule management with APCS Remote power source management for the main unit Installation server and dump server Functions of installation server and dump server for partitions, and the CD-ROM and DAT drives of the SMC are used as shared I/O devices Operation Registering of system administrator account of each partition (account management of each partition) 1.2 Assumed Operations (1) Providing access to the Internet and connecting the management LAN to an intranet Firewall Internet Service Service HUB Intranet REMCS Center Partition#0 Partition#1 User (Administration LAN) Mail notification Internet Console Connection Unit Mail http Firewall System Control Facility Mail notification System Control LAN Connection to other device is prohibited HUB System Management Consol NTP Server HUB System administrator A system installed within an intranet is used for such operations. In principle, firewalls restrict access to the internet and access from the intranet to the Internet. 1-2 C120-E142-01EN

11 1.2 Assumed Operations (2) Using disconnected systems from an external network HUB Intranet Partition#0 Partition#1 User (Administration LAN) Console Connection Unit System Control Facility System Control LAN Connection to other device is prohibited HUB System Management Consol NTP Server Mail notification System administrator The following SMC functions for use in a network cannot be used: Monitoring and maintenance Monitoring message notification to REMCS Center ( ) Downloading firmware from REMCS Center (http) C120-E142-01EN 1-3

12 Environment for SMC Operation (3) Completely preventing unauthorized intrusions of the SMC through partitions connected to the Internet and through partitions connected to intranets The following operations are implemented as the SMC functions for use in networks: Time synchronization The NTP server must use the NTP source on the Internet or an intranet for partition time synchronization. Monitoring and maintenance Monitoring message notification ( ) from a partition must be sent within an intranet to the system administrator. Installation server and dump server Only during maintenance work are the CD-ROM and DAT drives of the SMC to be used as shared I/O devices and the functions of the installation server and dump server of a partition to be connected to the user LAN. NTP Server Service Partition#0 External service Mail notification Console Connection Unit Partition#1 Internal service Mail notification HUB HUB NTP Server Intranet Mail notification System administrator REMCS Center Firewall Internet System Control Facility System Control LAN Connection to other device is prohibited HUB User (Administration LAN) System Management Consol Mail System administrator System Seciton Network 1-4 C120-E142-01EN

13 1.2 Assumed Operations (4) Connecting the system to the REMCS Center using the dialup router To prevent unauthorized intrusions of the SMC from the Internet, use the dialup router to connect the dedicated port of the SMC directly to the REMCS center. NTP Server Service Mail notification Mail notification HUB NTP Server Intranet System administrator Partition#0 External service Partition#1 Internal service Mail notification Console Connection Unit HUB System administrator REMCS Center System Control Facility System Control LAN Connection to other device is prohibited HUB User (Administration LAN) System Management Consol Mail notification Dialup router C120-E142-01EN 1-5

14

15 2. Security Measures 2.1 Handling Security Software Security can be enhanced by installation of firewall software such as Safegate. For information about the software to install, consult your Fujitsu engineer Firewall/gateway support (1) Restrictions (2) Precautions System Console Software is assumed to be used in an environment connected to either an intranet or the Internet, and in a DMZ. As far as the following components are concerned, some restrictions and precautions apply because of their unique characteristics. Web-based Administration View Assumed to be used in an environment that allows direct access to components within an intranet. Not supported beyond the firewall when a component is used on an intranet. A server in an intranet cannot be accessed from the client side via an Internet connection, and vice versa. Machine administration The connection of the main unit and SMC is limited to a LAN in the same segment. Remote support (REMCS) To communicate with the REMCS center, the http and SMTP protocol must be passed from the SMC to the Internet, and vice versa. (a) Protocol: SMTP Function: Direction of starting a session: Encipherment: IP address conversion: Gateway server: Firewall policy: Notifies the REMCS center of error messages From the SMC to REMCS support center Uses DES No problem (because communication uses SMTP) Existing SMTP servers can be used. Complies with the (SMTP) policy C120-E142-01EN 2-1

16 Security Measures (b) Protocol: SMTP Function: Direction of starting a session: Encipherment: IP address conversion: Gateway server: Firewall policy: (c) Protocol: http Function: Direction of starting a session: Encipherment: IP address conversion: Gateway server: Firewall policy: Confirms connection at the time of registration From the REMCS center to SMC Uses DES No problem (because communication uses SMTP) Existing SMTP servers can be used. Complies with the (SMTP) policy Downloads firmware from the REMCS center From the SMC to REMCS center Uses DES No problem (because communication uses http) Existing http-proxy servers can be used. Complies with the WWW (http) policy. 2.2 Solaris installation On Solaris, the following groups of software can be selected for installation. These groups are preinstalled with "Entire Distribution plus OEM Support" at the time the console is shipped. To reinstall the Solaris OS, use the "Entire Distribution plus OEM Support." Core System Support This software group includes the minimum software required for starting the Solaris operating environment and executing tasks on a system. End User System Support This software group includes the software recommended for end users in addition to the Core System Support software. Developer System Support This software group includes the libraries, include files, manual pages, and programming tools for software development, as well as the software in the End User System Support software group. Entire Distribution This software group includes all Solaris releases Entire Distribution plus OEM Support This software group includes software for extended hardware support, in addition to the Entire Distribution software. 2-2 C120-E142-01EN

17 2.3 Package Configuration 2.3 Package Configuration The following tables list the packages incorporated in System Console Software and SMC REMCS Agent Package configuration of System Console Software No. Component Package name Function 1 SCS information FJSVscs Stores the version information of System Console Software (SCS) 2 Machine administration 1 FJSVcsl Controls the PRIMEPOWER800/1000/2000 and GP7000F model 1000/2000, and monitors their statuses 3 Online manual FJSVcslom Online manual for System Console Software (HTML format) 4 Automatic power supply control FJSVapcs Implements the automatic power supply control for the PRIMEPOWER800/1000/2000 and GP7000F model 1000/ Partition installer FJSVclis OS-specified auxiliary tool installed in each partition of the PRIMEPOWER800/1000/2000 and GP7000F model 1000/ RC2000 FJSVrcon Controls the console screen for each partition of the PRIMEPOWER800/1000/2000 and GP7000F model 1000/ Dump auxiliary FJSVdmp Collects an OS dump for each partition of the PRIMEPOWER800/1000/2000 and GP7000F model 1000/ System information collection tool FJSVsnap Collects hardware and software configuration of the system console (System Management Console), environment settings, log status, and operating status, and records system information to the recording medium such as magnetic tape device for investing errors. 9 Console auxiliary FJSVscsl Group of auxiliary tools for System Console Software and the system console (System Management Console). 10 Machine administration 2 FJSVmand FJSVmasv FJSVmaom Controls the PRIME POWER 100 SMC and monitor its status (*1) C120-E142-01EN 2-3

18 Security Measures No. Component Package name Function 11 SCF driver FJSVscd FJSVscdx FJSVscr FJSVscu FJSVscuj Device driver for RAS control (*1) 12 Web-Based Admin View 13 Sever Defalt Configuration FJSVwvcnf FJSVwvbs FJSVdef Dedicated WWW server and communication base function for using Web-based Administration View (*1) Enables the crash dump saving function to prevent a shortage of file system space resulting from increases in the system log (*1) 14 VTS FJSVvts SUNWvts SUNWvtsm SUNWvtsx Conducts an online diagnosis test (*1) *1 Installed only on the PRIMEPOWER 100 SMC Package configuration of SMC REMCS Agent No. Component Package name Function 1 Main component of REMCS Agent FJSVsmcrm Offers the function for notifying the REMCS center of the unit status and error information about the PRIMEPOWER800/1000/2000 and GP7000F model 1000/ Software maintenance 3 REMCS Agent library 4 SystemWaker Application support 5 SystemWaker System monitor 6 SystemWaker Resource distribution FJSVsirms FJSVrlib FJSVrmaos FJSVragt FJSVrrda Offers a function for collecting software information Auxiliary function for notifying the REMCS center Auxiliary function for notifying the REMCS center Auxiliary function for notifying the REMCS center Auxiliary function for notifying the REMCS center 7 Online manual FJSVsmcro Online manual of the REMCS Agent Operator's Guide (written in HTML) 2-4 C120-E142-01EN

19 2.3 Package Configuration rc scripts and daemons running on System Console Software/SMC REMCS Agent This section explains the rc scripts registered and daemon processes active in System Console Software and SMC REMCS Agent. Of the rc scripts, only the startup scripts are explained in this section. The term of "stoppability" used below indicates whether the start script is disabled, such as by deletion. "Impact from stop" means the impact of disabling the startup script, such as by deletion. (1) All console units 1. rc scripts and daemons running on System Console Software 1) /etc/rcs.d S99FJSVclisinstall Component Package name Function Daemon started Port used Stoppability Impact from stop Installer FJSVclis NFS-mount a CD image, product on the SMC, and then installs the product in a partition on the network after setting up partitions. To enable network operations, the system restarts automatically after installation is completed. This script ends with no operation during restart processing. None None No daemon started No daemon started S90FJSVfdaemon (When using PW100 SMC) Component SCF driver Package name Function Daemon started Port used Stoppability Impact from stop FJSVlscr Starts the daemon for controlling the RAS control device pwrcthd Refer to the ESF User's Guide. None Unstoppable This has a great impact on the maintenance of hardware in the SMC itself. The hardware errors (such as those involving the power supply, temperature, and fan) monitored by the RAS control device are not monitored at all. C120-E142-01EN 2-5

20 Security Measures 2) letc/rc2.d S40FJSVevhand (When using PW100 SMC) Component Machine administration Package name Function Daemon started Port used Stoppability Impact from stop FJSVmand Provides the hardware error monitoring function for the SMC itself. evhandsd: Extracts messages concerning monitored from the syslog messages evmond: Reports errors in accordance with the extracted message Uses one port allocated dynamically by an OS Unstoppable Hardware errors cannot be detected S80FJSVwvbs (When using PW100 SMC) Component Web-Based Admin View Package name Function Daemon started Port used Stoppability Impact from stop FJSVwvbs Communications base function for Web applications java (java -mx32m com.fujitsu.webview.base*): Function for communications between a server and client when Web-based Administration View is used for GUI-based machine administration wvrespawn: Daemon for automatic reboot in the event that the above daemon (java) terminates abnormally fjwv_s 9398/tcp # FJSVwvbs RM1 registory fjwv_n 9397/tcp # FJSVwvbs RM1 registory fjwv_c 9399/tcp # FJSVwvbs RM1 registory Stoppable Machine administration of the SMC itself and use of the SafeDisk GUI menu are not possible. 2-6 C120-E142-01EN

21 2.3 Package Configuration S90FJSVscf (When using PW100 SMC) Component SCF driver Package name Function Daemon started Port used Stoppability Impact from stop FJSVlscr Collects the hardware error log information collected by the RAS control device None Stoppability Unstoppable This has an impact on the maintenance of hardware in the SMC itself. The hardware error log information collected by the RAS control device cannot be collected. S98FJSVmadm (When using PW100 SMC) Component Machine administration Package name FJSVmand Function Provides the hardware error monitoring and notification function Daemon started hardmond: Monitors for hardware errors using the information sources other than syslog (e.g., monitoring for dirt in the tape unit) Port used None Stoppability Impact from stop Unstoppable Hardware errors cannot be detected. S98FJSVscsl Component Package name Function Daemon started Port used Stoppability Impact from stop RC2000 FJSVrcon Collects the console log for each Kaiser partition Daemon for monitoring daemons for collecting logs None Unstoppable Maintenance work cannot be performed because the system log for the PRIMEPOWER800/1000/2000 and GP7000F model 1000/2000 cannot be collected. C120-E142-01EN 2-7

22 Security Measures Component Machine administration Package name FJSVcsl Function Controls the main unit, and monitor its status Daemon started upserrmd: Monitors the service life of UPS as well as FAN and FEP of FDE. madminitd: Manages the machine administration function Ftpcheck: Manages ftp control Fad: Performs file access operation on the SMC Scfd: Manages communications between SCF and SMC Logd: Manages the log information and configuration information of the main unit Scfconsd: Manages the console path of the OS of the main unit alive_check: Monitors the system management LAN ip_updown: Allocates the IP information for the system management LAN par_info: Manages partition information Timectl: Synchronizes times of the SMC and SCF lan_bd: Manages RCI data Restord: Saves and restores the NVRAM/OBP environment variables Firmctld: Updates firmware Monitord: Issues the periodic events occurring on the SMC Eventd: Allocates events from SCF Port used Daemon: Port number upserrmd: Uses one port allocated dynamically by an OS. fad: 5555/TCP scfd: Uses 8022/udp and one port allocated dynamically for each SCF. scfconsd: 5000/tcp sscfconsd: 5001/tcp evntd: 8023/tcp Stoppability Unstoppable Impact from stop The console functions of the SMC do not work. 2-8 C120-E142-01EN

23 2.3 Package Configuration S9apcs The program in the following script can also be started: /etc/re0.d/k10apcs /etc/rc1.d/k10apcs Component Package name Function Daemon started Port used Stoppability Impact from stop Automatic power supply control FJSVapcs Function that automatically turns the main unit on and off automatically according to the date. Apcsat None Stoppable cron is an equivalent function. This daemon is designed for users who want to stop using cron because of security reasons 3) etc/rc3.d S99FJSVwvbs (When using PW100 SMC) Component WWW Server for Admin View Package name Function Daemon started Port used Stoppability Impact from stop FJSVwvcnf Dedicated WWW server for using Web-based Administration View http daemon for using GUI-based machine administration by using wvcnfd Web-based Administration View Fjwv-h 8081/tcp # FJSVwvcnf Web Port Stoppable Machine administration of the SMC itself and use of the SafeDisk GUI menu are not possible. C120-E142-01EN 2-9

24 Security Measures 4) Daemon started in a procedure other than the rc procedure Daemon started from inetd (When using PW100 SMC) Component Communicates with partitions and relays the error event information Daemon started Port used Stoppability Impact from stop evrcvd evpassd 9799 (evrcvd) 9789 (evpassd) Stoppable Errors occurring on a partition are not reported to the SMC. The SIRMS function does not operate correctly on the partition. If you do not use this daemon, have your Fujitsu engineer set up the SMC REMCS Agent so that errors are reported to the partition itself. 2. rc scripts and daemons running on REMCS Agent 1) /etc/rc2.d S73rmagt.syslog Component Package name Function Daemon started Port used Stoppability Impact from stop Remote support FJSVragt REMCS Agent (for software monitoring) f3crlsys None Stoppable SupportDesk is disabled C120-E142-01EN

25 2.3 Package Configuration S98FJSVscsl Component Package name Function Daemon started Port used Stoppability Impact from stop FJSVscmrm FJSVscmrm Linking with the machine administration function, REMCS Agent (FJSVcmrm) provides a function for notifying the REMCS center of unit status and error information. remotereportd: Function for sending notifications to the REMCS center and for receiving firmware. rsched: Function for managing periodic connections to the REMCS center. None Unstoppable The REMCS functions cannot be used. S99SystemWalkerSS Component Package name Function Daemon started Remote support (REMCS) FJSVrmos, FJSVragt Notifies the REMCS center of errors f3crkrty, f3crkxsv Port used 19369/tcp #FJSVrmos REMCS SS-Agent 19370/tcp #FJSVrmos REMCS SS-Agent Stoppability Impact from stop Stoppable The functions of REMCS Agent cannot be used. C120-E142-01EN 2-11

26 Security Measures (2) When using PW100 SMC When using PW100 SMC, the following rc scripts start as well as the rc scripts described in (1). 1) etc/rc3.d S99FJSVwvbs Component Package name Function Daemon started Port used Stoppability Impact from stop WWW Server for Admin View FJSVwvcnf Dedicated WWW server for using Web-based Administration View http daemon for using GUI-based machine administration by using wvcnfd Web-based Administration View fjwv-h 8081/tcp # FJSVwvcnf Web Port Stoppable Machine administration of the SMC itself and use of the SafeDisk GUI menu are not possible. 2) Daemon started in a procedure other than the rc procedure Daemon started from inetd Component Communicates with partitions and relays the error event information Daemon started Port used Stoppability Impact from stop evrcvd evpassd 9799 (evrcvd) 9789 (evpassd) Stoppable Errors occurring on a partition are not reported to the SMC. The SIRMS function does not operate correctly on the partition. If you do not use this daemon, have your Fujitsu engineer set up the SMC REMCS Agent so that errors are reported to the partition itself C120-E142-01EN

27 2.3 Package Configuration TCP/IP ports used by System Console Software/SMC REMCS Agent The ports listed below are used by System Console Software. In addition, one port allocated dynamically by an OS is used for each SCF. These ports cannot be disabled. If they are disabled, the functions of System Console Software cannot be used. 1) TCP/IP ports used by System Console Software The TCP/IP ports listed below are used by System Console Software. These ports cannot be disabled. 5000/tcp 5001/tcp 5555/tcp 8022/udp 8023/udp 8081/tcp 9397/tcp 9398/tcp 9399/tcp 9798/tcp 9799/tcp 2) TCP/IP ports used for REMCS Agent The TCP/IP ports listed below are used by REMCS Agent. Disable these ports when REMCS Agent is not using them /tcp 19370/tcp /etc/inet/inetd.conf used by System Console Software The following statements have been added to FJSVcsl: Evrcvd stream tcp nowait root /opt/fjsvcsl/lib/evrcfd Evpassd stream tcp nowait root /opt/fjsvcsl/lib/evpassd The above statements are essential for System Console Software to be capable of monitoring the main unit. Do not delete these statements /etc/inet/service used by System Console Software In System Console Software, the following ports are added to /etc/inet/service at the time of installation. Evpassd Evprcvd 9798/tcp # FJSVcsl 9799/tcp # FJSVcsl This port is essential for monitoring the main unit, which is a basic function of System Console Software. Do not delete the statements. C120-E142-01EN 2-13

28 Security Measures Setting up cron for use with System Console Software crontab(1) This section explains how to set up crontab(1) and at(1) for used with System Console Software. Additional settings for crontab(1) of the root user Machine administration at(1) 13 2 * * 0 /opt/fjsvcsl/lib/csl.weeily #FJSVcsl 17 2 * * * /opt/fjsvcsl/lib/csl.daily #FJSVcsl 0 * * * * /opt/fjsvcsl/lib/csl.hourly #FJSVcsl - Component: Machine administration - Package name: FJSVcsl - Function: Controls the main unit, and monitors the status - Stoppability: Unstoppable - Impact from stop: The console functions of the SMC do not work. Additional setting for at(1) of the root user Automatic power supply control (APCS) (FJSVapcs) cd /opt/fjsvapcs/sbin umask 22 /opt/fjsvapcs/sbin/schedset - Component: Automatic power supply control (APCS) - Package name: FJSVapcs - Function: Automatically turns the power supply on and off. This function is registered at the start of the schedule for automatic power supply control. - Stoppability: Unstoppable when the automatic power supply control is used - Impact from stop: Automatic power supply control cannot be used. - Supplementary information: A method of implementing the automatic power supply control function without using cron is available from SCS1.5. If cron is not used, the daemon for APCS starts during boot. The apcschmod command is used for specifying whether or not to use cron C120-E142-01EN

29 2.4 Solaris OS /etc/dfs/dfstab used in System Console Software System In System Console Software, the following statements are added to /etc/dfs/dfstab at the time of installation. share F nfs o ro, anon=0 /export/install /usr/sbin/share F nfs o sec=sys, ro=partition 0:partition1, anon=0 d FJSVcsl /var/opt/fjsvcsl/export #FJSVcsl To apply security guard to the NFS in order to meet security requirements, delete share -F nfs -o ro, anon=0 /export/install" after installation is completed. After specifying settings so that the domain name is acquired by the name service on the OS for a console and partition, change the /etc/dfs/dfstab file in the following way: share F nfs o secure, ro=<system console software>, root=<system console software>, and=0 /var/opt/fjsvdmp/danshare /usr/sbin/share F nfs o serure, ro=<system console software>, anon=0 d FJSVmadm /var/opt/fjsvmadm/export #FJSVmadm Routing (1) Settings on a partition If the LAN connected to the system console is disconnected from the user LAN, make sure that the packets on the network are not rerouted. On Solaris, packets may be IP-forwarded if software settings are not changed after installation (default settings). Create the following file to release IP-forwarding. /etc/notrouter (2) Settings on the SMC 2.4 Solaris OS The following file is created automatically by installing System Console Software. Do not delete it. /etc/notrouter This section explains the security precautions for Solaris, which is used as the SMC OS. C120-E142-01EN 2-15

30 Security Measures Using the security patch of Solaris On Solaris, a security patch is provided for resolving security problems. Visit the following web site periodically to download and apply the security patch Assurance of account security If the following privileges of the SMC are taken away, security for all partitions controlled by the SMC is at risk: Root user cladmin group cemainte group In addition, if the following privilege is taken away, the security of the corresponding partition is at risk: Partition control group Be sure that the passwords for root users and users in these groups are set correctly and that the user environment settings have no problems in regards to security. In general, if general users other than the above users can log into the SMC, the security risk increases. Make sure that the passwords of all applicable user accounts, including the default user accounts created by the operating system, are set correctly. Fujitsu recommends that the number of unnecessary user accounts be minimized Settings for Naming Service (NIS/NIS+) NTP settings Take note of the SMC settings for a client of Naming Service (NIS/NIS+) because if the administrator privilege for the naming server is taken away, false user information may be passed, and the same problem as that mentioned in Section may arise. If there is a dramatic change of the time on the NTP server referred to by the SMC, the result is errors in the partitions that refer to the SMC as the server. Do not specify settings that obtain time data from an unreliable NTP server outside the system. Also, take care when managing the administrator privilege with the NTP server C120-E142-01EN

31 2.4 Solaris OS Other security measures (1) X window system settings (2) NFS settings (3) Dump transfer function Depending on the settings of the X window system for users who log into the SMC, problems may arise, such as unauthorized monitoring of SMC operations. Take care when changing user settings from their default settings. With the SMC, CD-ROM data is specified for distribution in NFS so the CD-ROM drive can be seen from each partition. To use CD-ROM data that you do not want users in other partitions to see, place restrictions on distribution in NFS. Crash dumps and fjsmap output of the system include security information. When transferring the dump data of a partition to the SMC by executing the fjdmptrans command, select storage destinations that have restricted access rights to their directories. This prevents users other than system administrators from referring to the data. C120-E142-01EN 2-17

32

33 3. Preparing against Access of Partitioned OS This chapter explains how to strengthen the measures for preventing unauthorized intrusions of a partitioned OS. 3.1 Disconnecting the Management LAN Unauthorized intrusions can be prevented between partitions via the management LAN and between the system console and a partition. This can be done by disconnecting partitions from the management LAN. The following explains how to release connections to the management LAN Requirements for disconnection The following requirements must be met in order to disconnect a partition from the management LAN. Version of Enhanced Support Facility Use Enhanced Support Facility 1.8 or later. Installing the NTP server Perform NTP operations without using the management LAN to synchronize the time of partitions. C120-E142-01EN 3-1

34 Preparing against Access of Partitioned OS Restrictions resulting from disconnection The following restrictions apply when a connection with the management LAN is released: Error notification In the event of a hardware error detection, the resulting error notification differs from the normal notification. A hardware error detected in OS operation is recorded in the "machine administration monitoring log" and /var/adm/messages on each partition, and it is not included in the log of the system console. Nor is it reported to the REMCS center. To send notification of the error by mail, specify the appropriate mail address in the procedure explained below. The notification function of the system console is used to report errors during the initial diagnosis and the whole devices. Operation when using a common I/O device To use the system console as a shared I/O device for collecting dump data or for installation, a connection to the management LAN is necessary. Install another device as a shared external I/O device, or connect the LAN cable only when such an I/O device is used. Remember to plug in or remove the cable on the hub. Functions pertaining to preventative maintenance Information for preventative maintenance cannot be migrated when System Console Software is reinstalled and when the console is changed to a spare console. Consequently, the functions for preventative maintenance cannot be used after either of the above events. Use of GUI image The operation management GUI image of the different kinds of applications on partitions cannot be displayed on the system console. To specify settings, confirm the status, and perform maintenance work on an application, log in from the console screen (RC2000) and use the GUI menu and command line of the respective product. 3-2 C120-E142-01EN

35 3.1 Disconnecting the Management LAN Procedures for disconnection To disconnect a partition from the management LAN, perform the following procedures on each partition. 1. Shut down the network interface. Shut down the network interface for management LAN connections. # ifconfig XXX down (XXX is the interface name used for the management LAN.) Also, delete the following file so that the network interface does not start at the next startup. # rm./etc/hostname.xxx (XXX is the interface name used for the management LAN.) 2. Specifying an address for mail notification Specify the address used for mail notification in the event an error is detected. The following file is created to define the address. /var/opt/fjsvmadm/etc/evsnd.mail The file contains the address of the destination defined on one line (up to 256 characters). To register multiple addresses, specify them by using "," as the delimiter. 3. Restarting the machine administration function Restart the machine administration function. If an error is detected after restart, it is reported to the specified mail a Solaris OS Solaris OS ddress. Execute the following command to restart the machine administration function. # /etc/init.d/fjsvmadm stop # /etc/init.d/fjsvmadm start C120-E142-01EN 3-3

36

37

38 Information on this document On April 1, 2009, Fujitsu became the sole owner of Fujitsu Siemens Computers. This new subsidiary of Fujitsu has been renamed Fujitsu Technology Solutions. This document from the document archive refers to a product version which was released a considerable time ago or which is no longer marketed. Please note that all company references and copyrights in this document have been legally transferred to Fujitsu Technology Solutions. Contact and support addresses will now be offered by Fujitsu Technology Solutions and have the The Internet pages of Fujitsu Technology Solutions are available at and the user documentation at Copyright Fujitsu Technology Solutions, 2009 Hinweise zum vorliegenden Dokument Zum 1. April 2009 ist Fujitsu Siemens Computers in den alleinigen Besitz von Fujitsu übergegangen. Diese neue Tochtergesellschaft von Fujitsu trägt seitdem den Namen Fujitsu Technology Solutions. Das vorliegende Dokument aus dem Dokumentenarchiv bezieht sich auf eine bereits vor längerer Zeit freigegebene oder nicht mehr im Vertrieb befindliche Produktversion. Bitte beachten Sie, dass alle Firmenbezüge und Copyrights im vorliegenden Dokument rechtlich auf Fujitsu Technology Solutions übergegangen sind. Kontakt- und Supportadressen werden nun von Fujitsu Technology Solutions angeboten und haben die Die Internetseiten von Fujitsu Technology Solutions finden Sie unter und unter finden Sie die Benutzerdokumentation. Copyright Fujitsu Technology Solutions, 2009