| blob | aa020f24f5f475108848a17e246bd0e00b2d646b |
1 '\" te
2 .\" Copyright (c) 2007, Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH SMTNRHTP 1M "Oct 31, 2007"
7 .SH NAME
8 smtnrhtp \- manage entries in the trusted network template database
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fB/usr/sadm/bin/smtnrhtp\fR \fIsubcommand\fR [\fIauth_args\fR] \fB--\fR [\fIsubcommand_args\fR]
13 .fi
15 .SH DESCRIPTION
16 .sp
17 .LP
18 The \fBsmtnrhtp\fR command adds, modifies, deletes, and lists entries in the
19 \fBtnrhtp\fR database.
20 .sp
21 .LP
22 \fBsmtnrhtp\fR \fIsubcommand\fRs are:
23 .sp
24 .ne 2
25 .na
26 \fB\fBadd\fR\fR
27 .ad
28 .RS 10n
29 Adds a new entry to the \fBtnrhtp\fR database. To add an entry, the
30 administrator must have the \fBsolaris.network.security.read\fR and
31 \fBsolaris.network.security.write\fR authorizations.
32 .RE
34 .sp
35 .ne 2
36 .na
37 \fB\fBmodify\fR\fR
38 .ad
39 .RS 10n
40 Modifies an entry in the \fBtnrhtp\fR database. To modify an entry, the
41 administrator must have the \fBsolaris.network.security.read\fR and
42 \fBsolaris.network.security.write\fR authorizations.
43 .RE
45 .sp
46 .ne 2
47 .na
48 \fB\fBdelete\fR\fR
49 .ad
50 .RS 10n
51 Deletes an entry from \fBtnrhtp\fR database. To delete an entry, the
52 administrator must have the \fBsolaris.network.security.read\fR and
53 \fBsolaris.network.security.write\fR authorizations.
54 .RE
56 .sp
57 .ne 2
58 .na
59 \fB\fBlist\fR\fR
60 .ad
61 .RS 10n
62 Lists entries in the \fBtnrhtp\fR database. To list an entry, the administrator
63 must have the \fBsolaris.network.security.read\fR authorizations.
64 .RE
66 .SH OPTIONS
67 .sp
68 .LP
69 The \fBsmtnrhtp\fR authentication arguments, \fIauth_args\fR, are derived from
70 the \fBsmc\fR argument set and are the same regardless of which subcommand you
71 use. The \fBsmtnrhtp\fR command requires the Solaris Management Console to be
72 initialized for the command to succeed (see \fBsmc\fR(1M)). After rebooting the
73 Solaris Management Console server, the first smc connection can time out, so
74 you might need to retry the command.
75 .sp
76 .LP
77 The subcommand-specific options, \fIsubcommand_args\fR, must be \fBpreceded\fR
78 by the \fB--\fR option.
79 .SS "\fIauth_args\fR"
80 .sp
81 .LP
82 The valid \fIauth_args\fR are \fB-D\fR, \fB-H\fR, \fB-l\fR, \fB-p\fR, \fB-r\fR,
83 and \fB-u\fR; they are all optional. If no \fIauth_args\fR are specified,
84 certain defaults will be assumed and the user might be prompted for additional
85 information, such as a password for authentication purposes. These letter
86 options can also be specified by their equivalent option words preceded by a
87 double dash. For example, you can use either \fB-D\fR or \fB--domain\fR.
88 .sp
89 .ne 2
90 .na
91 \fB\fB-D\fR | \fB--domain\fR \fIdomain\fR\fR
92 .ad
93 .sp .6
94 .RS 4n
95 Specifies the default domain that you want to manage. The syntax of
96 \fIdomain\fR=\fItype\fR:/\fIhost_name\fR/\fIdomain_name\fR, where \fItype\fR is
97 \fBdns\fR, \fBldap\fR, or \fBfile\fR; \fIhost_name\fR is the name of the
98 server; and \fIdomain_name\fR is the name of the domain you want to manage.
99 .sp
100 If you do not specify this option, the Solaris Management Console assumes the
101 \fBfile\fR default domain on whatever server you choose to manage, meaning that
102 changes are local to the server. Toolboxes can change the domain on a
103 tool-by-tool basis; this option specifies the domain for all other tools.
104 .RE
106 .sp
107 .ne 2
108 .na
109 \fB\fB-H\fR | \fB--hostname\fR \fIhost_name:port\fR\fR
110 .ad
111 .sp .6
112 .RS 4n
113 Specifies the \fIhost_name\fR and \fIport\fR to which you want to connect. If
114 you do not specify a \fIport\fR, the system connects to the default port,
115 \fB898\fR. If you do not specify \fIhost_name:port\fR, the Solaris Management
116 Console connects to the local host on port \fB898\fR.
117 .RE
119 .sp
120 .ne 2
121 .na
122 \fB\fB-l\fR | \fB--rolepassword\fR \fIrole_password\fR\fR
123 .ad
124 .sp .6
125 .RS 4n
126 Specifies the password for the \fIrole_name\fR. If you specify a
127 \fIrole_name\fR but do not specify a \fIrole_password\fR, the system prompts
128 you to supply a \fIrole_password\fR. Passwords specified on the command line
129 can be seen by any user on the system, hence this option is considered
130 insecure.
131 .RE
133 .sp
134 .ne 2
135 .na
136 \fB\fB-p\fR | \fB--password\fR \fIpassword\fR\fR
137 .ad
138 .sp .6
139 .RS 4n
140 Specifies the password for the \fIuser_name\fR. If you do not specify a
141 password, the system prompts you for one. Passwords specified on the command
142 line can be seen by any user on the system, hence this option is considered
143 insecure.
144 .RE
146 .sp
147 .ne 2
148 .na
149 \fB\fB-r\fR | \fB--rolename\fR \fIrole_name\fR\fR
150 .ad
151 .sp .6
152 .RS 4n
153 Specifies a role name for authentication. If you do not specify this option, no
154 role is assumed.
155 .RE
157 .sp
158 .ne 2
159 .na
160 \fB\fB-u\fR | \fB--username\fR \fIuser_name\fR\fR
161 .ad
162 .sp .6
163 .RS 4n
164 Specifies the user name for authentication. If you do not specify this option,
165 the user identity running the console process is assumed.
166 .RE
168 .sp
169 .ne 2
170 .na
171 \fB\fB--\fR\fR
172 .ad
173 .sp .6
174 .RS 4n
175 This option is required and must always follow the preceding options. If you do
176 not enter the preceding options, you must still enter the \fB--\fR option.
177 .RE
179 .SS "\fIsubcommand_args\fR"
180 .sp
181 .LP
182 Descriptions and other argument options that contain white spaces must be
183 enclosed in double quotes.
184 .sp
185 .ne 2
186 .na
187 \fB\fB-h\fR\fR
188 .ad
189 .RS 26n
190 Displays the command's usage statement.
191 .RE
193 .sp
194 .ne 2
195 .na
196 \fB\fB-n\fR \fItemplatename\fR\fR
197 .ad
198 .RS 26n
199 Specifies the name of the template.
200 .RE
202 .sp
203 .ne 2
204 .na
205 \fB\fB-t\fR \fIhosttype\fR\fR
206 .ad
207 .RS 26n
208 Specifies the host type of the new host. Valid values are \fBunlabeled\fR and
209 \fBcipso\fR. The \fBcipso\fR host type is for hosts that use CIPSO (Common IP
210 Security Options - Tag Type 1 only) to label packets.
211 .RE
213 .sp
214 .ne 2
215 .na
216 \fB\fB-x\fR \fBdoi\fR=\fIdoi-value\fR\fR
217 .ad
218 .RS 26n
219 Specifies the \fBDOI\fR value (the domain of interpretation). In the case of
220 the \fBunlabeled\fR host type, this is the domain of interpretation for the
221 \fBdef_label\fR.
222 .sp
223 The domain of interpretation defines the set of rules for translating between
224 the external or internal representation of the security attributes and their
225 network representation. When systems that are configured with Trusted
226 Extensions software have the same \fBdoi\fR, they share that set of rules. In
227 the case of the \fBunlabeled\fR host type, these systems also share the same
228 interpretation for the default attributes that are assigned to the unlabeled
229 templates that have that same \fBdoi\fR.
230 .RE
232 .sp
233 .ne 2
234 .na
235 \fB\fB-x\fR \fBmax\fR=\fImaximum-label\fR\fR
236 .ad
237 .RS 26n
238 Specifies the maximum label. Together with \fBmin\fR, this value specifies the
239 label accreditation range for the remote hosts that use this template. Values
240 can be a hex value or string (such as \fBadmin_high\fR).
241 .RE
243 .sp
244 .ne 2
245 .na
246 \fB\fB-x\fR \fBmin\fR=\fIminimum-label\fR\fR
247 .ad
248 .RS 26n
249 Specifies the minimum label. Together with \fBmax\fR, this value specifies the
250 label accreditation range for the remote hosts that use this template. For
251 gateway systems, \fBmin\fR and \fBmax\fR define the default range for
252 forwarding labeled packets. The label range for routes is typically set by
253 using a \fBroute\fR(1M) subcommand with the \fB-secattr\fR option. When the
254 label range for routes is not specified, the \fBmin\fR to \fBmax\fR range in
255 the security template is used. Values can be a hex value or string (such as
256 \fBadmin_low\fR).
257 .RE
259 .sp
260 .ne 2
261 .na
262 \fB\fB-x\fR \fBlabel\fR=\fIdefault-label\fR\fR
263 .ad
264 .RS 26n
265 Specifies the default label to be applied to incoming data from remote hosts
266 that do not support these attributes. This option does not apply if
267 \fIhosttype\fR is \fBcipso\fR. Values can be a hex value or string (such as
268 \fBadmin_low\fR).
269 .RE
271 .sp
272 .ne 2
273 .na
274 \fB\fB-x\fR \fBslset\fR=\fIl1\fR,\fIl2\fR,\fIl3\fR,\fIl4\fR\fR
275 .ad
276 .RS 26n
277 Specifies a set of sensitivity labels. For gateway systems, the labels in
278 \fBslset\fR are used for forwarding labeled packets. \fBslset\fR is optional.
279 You can specify up to four label values, separated by commas. Values can be a
280 hex value or string (such as \fBadmin_low\fR).
281 .RE
283 .RS +4
284 .TP
285 .ie t \(bu
286 .el o
287 One of the following sets of arguments must be specified for subcommand
288 \fBadd\fR:
289 .sp
290 .in +2
291 .nf
292 \fB-n\fR \fItemplate name\fR (
293 .fi
294 .in -2
295 .sp
297 .RS +4
298 .TP
299 .ie t \(bu
300 .el o
301 \fB-t\fR \fBcipso\fR [ \fB-x\fR \fBdoi\fR=\fIdoi-value\fR \fB-x\fR
302 \fBmin\fR=\fIminimum-label\fR \fB-x\fR \fBmax\fR=\fImaximum-label\fR \fB-x\fR
303 \fBslset\fR=\fIl1\fR,\fIl2\fR,\fIl3\fR,\fIl4\fR ] |
304 .RE
305 .RS +4
306 .TP
307 .ie t \(bu
308 .el o
309 \fB-t\fR unlabeled [ \fB-x\fR \fBdoi\fR=\fIdoi-value\fR \fB-x\fR
310 \fBmin\fR=\fIminimum-label\fR \fB-x\fR \fBmax\fR=\fImaximum-label\fR \fB-x\fR
311 \fBlabel\fR=\fIdefault-label\fR \fB-x\fR
312 \fBslset\fR=\fIl1\fR,\fIl2\fR,\fIl3\fR,\fIl4\fR ] |
313 .RE
314 .RS +4
315 .TP
316 .ie t \(bu
317 .el o
318 \fB-h\fR
319 .RE
320 .sp
321 .in +2
322 .nf
323 )
324 .fi
325 .in -2
326 .sp
328 .RE
329 .RS +4
330 .TP
331 .ie t \(bu
332 .el o
333 One of the following sets of arguments must be specified for subcommand
334 \fBmodify\fR:
335 .sp
336 .in +2
337 .nf
338 \fB-n\fR \fItemplate name\fR (
339 .fi
340 .in -2
341 .sp
343 .RS +4
344 .TP
345 .ie t \(bu
346 .el o
347 \fB-t\fR \fBcipso\fR [ \fB-x\fR \fBdoi\fR=\fIdoi-value\fR \fB-x\fR
348 \fBmin\fR=\fIminimum-label\fR \fB-x\fR \fBmax\fR=\fImaximum-label\fR \fB-x\fR
349 \fBslset\fR=\fIl1\fR,\fIl2\fR,\fIl3\fR,\fIl4\fR ] |
350 .RE
351 .RS +4
352 .TP
353 .ie t \(bu
354 .el o
355 \fB-t\fR unlabeled [ \fB-x\fR \fBdoi\fR=\fIdoi-value\fR \fB-x\fR
356 \fBmin\fR=\fIminimum-label\fR \fB-x\fR \fBmax\fR=\fImaximum-label\fR \fB-x\fR
357 \fBlabel\fR=\fIdefault-label\fR\fB-x\fR
358 \fBslset\fR=\fIl1\fR,\fIl2\fR,\fIl3\fR,\fIl4\fR ] |
359 .RE
360 .RS +4
361 .TP
362 .ie t \(bu
363 .el o
364 \fB-h\fR
365 .RE
366 .sp
367 .in +2
368 .nf
369 )
370 .fi
371 .in -2
372 .sp
374 If the host type is changed, all options for the new host type must be
375 specified.
376 .RE
377 .RS +4
378 .TP
379 .ie t \(bu
380 .el o
381 One of the following sets of arguments must be specified for subcommand
382 \fBdelete\fR:
383 .sp
384 .in +2
385 .nf
386 \fB-n\fR \fItemplatename\fR |
387 \fB-h\fR
388 .fi
389 .in -2
390 .sp
392 .RE
393 .RS +4
394 .TP
395 .ie t \(bu
396 .el o
397 The following argument can be specified for subcommand \fBlist\fR:
398 .sp
399 .in +2
400 .nf
401 \fB-n\fR \fItemplatename\fR |
402 \fB-h\fR
403 .fi
404 .in -2
405 .sp
407 .RE
408 .SH EXAMPLES
409 .LP
410 \fBExample 1 \fRAdding a New Entry to the Network Template Database
411 .sp
412 .LP
413 The admin role connects to port \fB898\fR of the LDAP server and creates the
414 \fBunlabeled_ntk\fR entry in the \fBtnrhtp\fR database. The new template is
415 assigned a host type of \fBunlabeled\fR, a domain of interpretation of \fB1\fR,
416 minimum label of \fBpublic\fR, maximum label of \fBrestricted\fR, and a default
417 label of \fBneedtoknow\fR. The administrator is prompted for the admin
418 password.
420 .sp
421 .in +2
422 .nf
423 $ /usr/sadm/bin/smtnrhtp \e
424 add -D ldap:\fIdirectoryname\fR -H \fIservername\fR:898 -- \e
425 -n unlabeled_ntk -t unlabeled -x DOI=1 \e
426 -x min=public -x max=restricted -x label="need to know"
427 .fi
428 .in -2
429 .sp
431 .SH EXIT STATUS
432 .sp
433 .LP
434 The following exit values are returned:
435 .sp
436 .ne 2
437 .na
438 \fB\fB0\fR\fR
439 .ad
440 .RS 5n
441 Successful completion.
442 .RE
444 .sp
445 .ne 2
446 .na
447 \fB\fB1\fR\fR
448 .ad
449 .RS 5n
450 Invalid command syntax. A usage message displays.
451 .RE
453 .sp
454 .ne 2
455 .na
456 \fB\fB2\fR\fR
457 .ad
458 .RS 5n
459 An error occurred while executing the command. An error message displays.
460 .RE
462 .SH FILES
463 .sp
464 .LP
465 The following files are used by the \fBsmtnrhtp\fR command:
466 .sp
467 .ne 2
468 .na
469 \fB\fB/etc/security/tsol/tnrhtp\fR\fR
470 .ad
471 .RS 29n
472 Trusted network remote-host templates.
473 .RE
475 .SH ATTRIBUTES
476 .sp
477 .LP
478 See \fBattributes\fR(5) for descriptions of the following attributes:
479 .sp
481 .sp
482 .TS
483 box;
484 c | c
485 l | l .
486 ATTRIBUTE TYPE ATTRIBUTE VALUE
487 _
488 Interface Stability Committed
489 .TE
491 .SH SEE ALSO
492 .sp
493 .LP
494 \fBsmc\fR(1M), \fBattributes\fR(5)
495 .SH NOTES
496 .sp
497 .LP
498 The functionality described on this manual page is available only if the system
499 is configured with Trusted Extensions.
500 .SH WARNINGS
501 .sp
502 .LP
503 Changing a template while the network is up can change the security view of an
504 undetermined number of hosts.
505 .sp
506 .LP
507 Allowing unlabeled hosts onto a Solaris Trusted Extensions network is a
508 security risk. To avoid compromising the rest of your network, such hosts must
509 be \fBtrusted\fR in the sense that the administrator is certain that these
510 unlabeled hosts will not be used to compromise the distributed system. These
511 hosts should also be physically protected to restrict access to authorized
512 individuals. If you cannot guarantee that an unlabeled host is physically
513 secure from tampering, it and similar hosts should be isolated on a separate
514 branch of the network.
515 .sp
516 .LP
517 If the security template is modified while the network is up, the changes do
518 not take effect immediately unless \fBtnctl\fR(1M) is used to update the
519 template entries. Otherwise, the changes take effect when next polled by the
520 trusted network daemon, \fBtnd\fR(1M). Administrators are allowed to add new
521 templates and modify attributes of existing templates while the network is up.