| blob | 022c8f3cef4f947ee2efc55a8e686449077c87dc |
1 '\" te
2 .\" Copyright (c) 2007, Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH SMTNZONECFG 1M "Oct 31, 2007"
7 .SH NAME
8 smtnzonecfg \- manage entries in the zone configuration database for Trusted
9 Extensions networking
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fB/usr/sadm/bin/smtnzonecfg\fR \fIsubcommand\fR [\fIauth_args\fR] \fB--\fR [\fIsubcommand_args\fR]
14 .fi
16 .SH DESCRIPTION
17 .sp
18 .LP
19 The \fBsmtnzonecfg\fR command adds, modifies, deletes, and lists entries in the
20 \fBtnzonecfg\fR database.
21 .sp
22 .LP
23 \fBsmtnzonecfg\fR \fIsubcommand\fRs are:
24 .sp
25 .ne 2
26 .na
27 \fB\fBadd\fR\fR
28 .ad
29 .RS 10n
30 Adds a new entry to the \fBtnzonecfg\fR database. To add an entry, the
31 administrator must have the \fBsolaris.network.host.write\fR and
32 \fBsolaris.network.security.write\fR authorizations.
33 .RE
35 .sp
36 .ne 2
37 .na
38 \fB\fBmodify\fR\fR
39 .ad
40 .RS 10n
41 Modifies an entry in the \fBtnzonecfg\fR database. To modify an entry, the
42 administrator must have the \fBsolaris.network.host.write\fR and
43 \fBsolaris.network.security.write\fR authorizations.
44 .RE
46 .sp
47 .ne 2
48 .na
49 \fB\fBdelete\fR\fR
50 .ad
51 .RS 10n
52 Deletes an entry from the \fBtnzonecfg\fR database. To delete an entry, the
53 administrator must have the \fBsolaris.network.host.write\fR and
54 \fBsolaris.network.security.write\fR authorizations.
55 .RE
57 .sp
58 .ne 2
59 .na
60 \fB\fBlist\fR\fR
61 .ad
62 .RS 10n
63 Lists entries in the \fBtnzonecfg\fR database. To list an entry, the
64 administrator must have the \fBsolaris.network.host.read\fR and
65 \fBsolaris.network.security.read\fR authorizations.
66 .RE
68 .SH OPTIONS
69 .sp
70 .LP
71 The \fBsmtnzonecfg\fR authentication arguments, \fIauth_args\fR, are derived
72 from the \fBsmc\fR argument set and are the same regardless of which subcommand
73 you use. The \fBsmtnzonecfg\fR command requires the Solaris Management Console
74 to be initialized for the command to succeed (see \fBsmc\fR(1M)). After
75 rebooting the Solaris Management Console server, the first smc connection can
76 time out, so you might need to retry the command.
77 .sp
78 .LP
79 The subcommand-specific options, \fIsubcommand_args\fR, must be \fBpreceded\fR
80 by the \fB--\fR option.
81 .SS "\fIauth_args\fR"
82 .sp
83 .LP
84 The valid \fIauth_args\fR are \fB-D\fR, \fB-H\fR, \fB-l\fR, \fB-p\fR, \fB-r\fR,
85 and \fB-u\fR; they are all optional. If no \fIauth_args\fR are specified,
86 certain defaults will be assumed and the user can be prompted for additional
87 information, such as a password for authentication purposes. These letter
88 options can also be specified by their equivalent option words preceded by a
89 double dash. For example, you can use either \fB-D\fR or \fB--domain\fR.
90 .sp
91 .ne 2
92 .na
93 \fB\fB-D\fR | \fB--domain\fR \fIdomain\fR\fR
94 .ad
95 .sp .6
96 .RS 4n
97 Specifies the default domain that you want to manage. The syntax of
98 \fIdomain\fR=\fItype\fR:/\fIhost_name\fR/\fIdomain_name\fR, where \fItype\fR is
99 \fBdns\fR, \fBldap\fR, or \fBfile\fR; \fIhost_name\fR is the name of the
100 server; and \fIdomain_name\fR is the name of the domain you want to manage.
101 .sp
102 If you do not specify this option, the Solaris Management Console assumes the
103 \fBfile\fR default domain on whatever server you choose to manage, meaning that
104 changes are local to the server. Toolboxes can change the domain on a
105 tool-by-tool basis. This option specifies the domain for all other tools.
106 .RE
108 .sp
109 .ne 2
110 .na
111 \fB\fB-H\fR | \fB--hostname\fR \fIhost_name:port\fR\fR
112 .ad
113 .sp .6
114 .RS 4n
115 Specifies the \fIhost_name\fR and \fIport\fR to which you want to connect. If
116 you do not specify a \fIport\fR, the system connects to the default port,
117 \fB898\fR. If you do not specify \fIhost_name:port\fR, the Solaris Management
118 Console connects to the local host on port \fB898\fR.
119 .RE
121 .sp
122 .ne 2
123 .na
124 \fB\fB-l\fR | \fB--rolepassword\fR \fIrole_password\fR\fR
125 .ad
126 .sp .6
127 .RS 4n
128 Specifies the password for the \fIrole_name\fR. If you specify a
129 \fIrole_name\fR but do not specify a \fIrole_password\fR, the system prompts
130 you to supply a \fIrole_password\fR. Passwords specified on the command line
131 can be seen by any user on the system, hence this option is considered
132 insecure.
133 .RE
135 .sp
136 .ne 2
137 .na
138 \fB\fB-p\fR | \fB--password\fR \fIpassword\fR\fR
139 .ad
140 .sp .6
141 .RS 4n
142 Specifies the password for the \fIuser_name\fR. If you do not specify a
143 password, the system prompts you for one. Passwords specified on the command
144 line can be seen by any user on the system, hence this option is considered
145 insecure.
146 .RE
148 .sp
149 .ne 2
150 .na
151 \fB\fB-r\fR | \fB--rolename\fR \fIrole_name\fR\fR
152 .ad
153 .sp .6
154 .RS 4n
155 Specifies a role name for authentication. If you do not specify this option, no
156 role is assumed.
157 .RE
159 .sp
160 .ne 2
161 .na
162 \fB\fB-u\fR | \fB--username\fR \fIuser_name\fR\fR
163 .ad
164 .sp .6
165 .RS 4n
166 Specifies the user name for authentication. If you do not specify this option,
167 the user identity running the console process is assumed.
168 .RE
170 .sp
171 .ne 2
172 .na
173 \fB\fB--\fR\fR
174 .ad
175 .sp .6
176 .RS 4n
177 This option is required and must always follow the preceding options. If you do
178 not enter the preceding options, you must still enter the \fB--\fR option.
179 .RE
181 .SS "\fIsubcommand_args\fR"
182 .sp
183 .LP
184 Descriptions and other argument options that contain white spaces must be
185 enclosed in double quotes.
186 .sp
187 .ne 2
188 .na
189 \fB\fB-h\fR\fR
190 .ad
191 .sp .6
192 .RS 4n
193 Displays the command's usage statement.
194 .RE
196 .sp
197 .ne 2
198 .na
199 \fB\fB-n\fR \fIzonename\fR\fR
200 .ad
201 .sp .6
202 .RS 4n
203 Specifies the zone name for the entry. This name is used when the zone is
204 configured. See \fBzonecfg\fR(1M), under the \fB-z zonename\fR option, for the
205 constraints on zone names. The specified zone name must be one of the
206 configured zones on the system. The following command returns a list of
207 configured zones:
208 .sp
209 .in +2
210 .nf
211 /usr/sbin/zoneadm list -c
212 .fi
213 .in -2
214 .sp
216 .RE
218 .sp
219 .ne 2
220 .na
221 \fB\fB-l\fR \fIlabel\fR\fR
222 .ad
223 .sp .6
224 .RS 4n
225 Specifies the label for the zone. This field is used to label the zone when the
226 zone is booted. Each zone must have a unique label.
227 .RE
229 .sp
230 .ne 2
231 .na
232 \fB\fB-x policymatch\fR=\fB0\fR|\fB1\fR\fR
233 .ad
234 .sp .6
235 .RS 4n
236 Specifies the policy match level for non-transport traffic. Only values of
237 \fB0\fR (match the label) or \fB1\fR (be within the label range of the zone)
238 are accepted.
239 .sp
240 ICMP packets that are received on the global zone IP address are accepted based
241 on the label range of the global zone's security template if the global zone's
242 \fIpolicymatch\fR field is set to 1. When this field is set to 0 for a zone,
243 the zone will not respond to an ICMP echo request from a host with a different
244 label.
245 .sp
246 This subcommand argument is optional. If not specified, it will have a default
247 value of 0.
248 .RE
250 .sp
251 .ne 2
252 .na
253 \fB\fB-x mlpzone\fR=""|\fIport/protocol\fR\fR
254 .ad
255 .sp .6
256 .RS 4n
257 Specifies the multilevel port configuration entry for zone-specific IP
258 addresses. Multiple \fIport/protocol\fR combinations are separated by a
259 semi-colon. The empty string can be specified to remove all existing MLP zone
260 values. This subcommand argument is optional.
261 .sp
262 An MLP is used to provide multilevel service in the global zone as well as in
263 non-global zones. As an example of how a non-global zone can use an MLP,
264 consider setting up two labeled zones, \fBinternal\fR and \fBpublic\fR. The
265 \fBinternal\fR zone can access company networks; the \fBpublic\fR zone can
266 access public internet but not the company's internal networks. For safe
267 browsing, when a user in the \fBinternal\fR zone wants to browse the Internet,
268 the \fBinternal\fR zone browser forwards the URL to the \fBpublic\fR zone, and
269 the web content is then displayed in a \fBpublic\fR zone web browser. That way,
270 if the download in \fBpublic\fR zone compromises the web browser, it cannot
271 affect the company's internal network. To set this up, TCP port \fB8080\fR in
272 the \fBpublic\fR zone is an MLP (\fB8080/tcp\fR), and the security template for
273 the \fBpublic\fR zone has a label range from \fBPUBLIC\fR to \fBINTERNAL\fR.
274 .RE
276 .sp
277 .ne 2
278 .na
279 \fB\fB-x mlpshared\fR=""|\fIport/protocol\fR\fR
280 .ad
281 .sp .6
282 .RS 4n
283 Specifies the multilevel port configuration entry for shared IP addresses.
284 Multiple \fIport/protocol\fR combinations are separated by a semi-colon. The
285 empty string can be specified to remove all existing MLP shared values. This
286 subcommand argument is optional.
287 .sp
288 A shared IP address can reduce the total number of IP addresses that are needed
289 on the system, especially when configuring a large number of zones. Unlike the
290 case of the zone-specific IP address, when MLPs are declared on shared IP
291 addresses, only the global zone can receive the incoming network traffic that
292 is destined for the MLP.
293 .RE
295 .RS +4
296 .TP
297 .ie t \(bu
298 .el o
299 One of the following sets of arguments must be specified for subcommand
300 \fBadd\fR:
301 .sp
302 .in +2
303 .nf
304 \fB-n\fR \fIzonename\fR \fB-l\fR \fIlabel\fR [\fB-x\fR policymatch=\fIpolicy-match-level\fR \e
305 \fB-x\fR mlpzone=\fIport/protocol\fR;.... | \e
306 \fB-x\fR mlpshared=\fIport/protocol\fR;.... ]
307 \fB-h\fR
308 .fi
309 .in -2
310 .sp
312 .RE
313 .RS +4
314 .TP
315 .ie t \(bu
316 .el o
317 One of the following sets of arguments must be specified for subcommand
318 \fBmodify\fR:
319 .sp
320 .in +2
321 .nf
322 \fB-n\fR \fIzonename\fR [\fB-l\fR \fIlabel\fR] [\fB-x\fR policymatch=\fIpolicy-match-level\fR \e
323 \fB-x\fR mlpzone=\fIport/protocol\fR;.... |\e
324 \fB-x\fR mlpshared=\fIport/protocol\fR;.... ]
325 \fB-h\fR
326 .fi
327 .in -2
328 .sp
330 .RE
331 .RS +4
332 .TP
333 .ie t \(bu
334 .el o
335 One of the following arguments must be specified for subcommand \fBdelete\fR:
336 .sp
337 .in +2
338 .nf
339 \fB-n\fR \fIzonename\fR |
340 \fB-h\fR
341 .fi
342 .in -2
343 .sp
345 .RE
346 .RS +4
347 .TP
348 .ie t \(bu
349 .el o
350 The following argument can be specified for subcommand \fBlist\fR:
351 .sp
352 .in +2
353 .nf
354 \fB-n\fR \fIzonename\fR |
355 \fB-h\fR
356 .fi
357 .in -2
358 .sp
360 .RE
361 .SH EXAMPLES
362 .LP
363 \fBExample 1 \fRAdding a New Entry to the Zone Configuration Database
364 .sp
365 .LP
366 The admin role creates a new zone entry, \fBpublic\fR, with a label of
367 \fBpublic\fR, a policy match level of 1, and a shared MLP port and protocol of
368 666 and TCP. The administrator is prompted for the admin password.
370 .sp
371 .in +2
372 .nf
373 $ \fB/usr/sadm/bin/smtnzonecfg add -- -n public -l public \e
374 -x policymatch=1 -x mlpshared=666/tcp\fR
375 .fi
376 .in -2
377 .sp
379 .LP
380 \fBExample 2 \fRModifying an Entry in the Zone Configuration Database
381 .sp
382 .LP
383 The admin role changes the \fBpublic\fR entry in the \fBtnzonecfg\fR database
384 to \fBneedtoknow\fR. The administrator is prompted for the admin password.
386 .sp
387 .in +2
388 .nf
389 $ \fB/usr/sadm/bin/smtnzonecfg modify -- -n public -l needtoknow\fR
390 .fi
391 .in -2
392 .sp
394 .LP
395 \fBExample 3 \fRListing the Zone Configuration Database
396 .sp
397 .LP
398 The admin role lists the entries in the \fBtnzonecfg\fR database. The
399 administrator is prompted for the admin password.
401 .sp
402 .in +2
403 .nf
404 $ \fB/usr/sadm/bin/smtnzonecfg list --\fR
405 .fi
406 .in -2
407 .sp
409 .SH EXIT STATUS
410 .sp
411 .LP
412 The following exit values are returned:
413 .sp
414 .ne 2
415 .na
416 \fB\fB0\fR\fR
417 .ad
418 .RS 5n
419 Successful completion.
420 .RE
422 .sp
423 .ne 2
424 .na
425 \fB\fB1\fR\fR
426 .ad
427 .RS 5n
428 Invalid command syntax. A usage message displays.
429 .RE
431 .sp
432 .ne 2
433 .na
434 \fB\fB2\fR\fR
435 .ad
436 .RS 5n
437 An error occurred while executing the command. An error message displays.
438 .RE
440 .SH FILES
441 .sp
442 .LP
443 The following files are used by the \fBsmtnzonecfg\fR command:
444 .sp
445 .ne 2
446 .na
447 \fB\fB/etc/security/tsol/tnzonecfg\fR\fR
448 .ad
449 .sp .6
450 .RS 4n
451 Trusted zone configuration database.
452 .RE
454 .SH ATTRIBUTES
455 .sp
456 .LP
457 See \fBattributes\fR(5) for descriptions of the following attributes:
458 .sp
460 .sp
461 .TS
462 box;
463 c | c
464 l | l .
465 ATTRIBUTE TYPE ATTRIBUTE VALUE
466 _
467 Interface Stability Committed
468 .TE
470 .SH SEE ALSO
471 .sp
472 .LP
473 \fBsmc\fR(1M), \fBattributes\fR(5)
474 .SH NOTES
475 .sp
476 .LP
477 The functionality described on this manual page is available only if the system
478 is configured with Trusted Extensions.