Configuring the Sun Java System Directory Server on a Trusted Extensions System
The LDAP naming service is the supported naming service for Trusted Extensions. If
your site is not yet running the LDAP naming service, configure a
Sun Java System Directory Server (Directory Server) on a system that is configured
with Trusted Extensions. If your site is already running a Directory Server, then
you need to add the Trusted Extensions databases to the server. To access
the Directory Server, you then set up an LDAP proxy on a Trusted
Extensions system.
Note - If you do not use this LDAP server as an NFS server
or as a server for Sun RayTM clients, then you do not need
to install any labeled zones on this server.
Collect Information for the Directory Server for LDAP
Install the Sun Java System Directory Server
The Directory Server packages are available from the Sun Software Gateway web site.
- Find the Sun Java System Directory Server packages on the Sun web
site.
- On the Sun Software Gateway page, click the Get It tab.
- Click the checkbox for the Sun Java Identity Management Suite.
- Click the Submit button.
- If you are not registered, register.
- Log in to download the software.
- Click the Download Center at the upper left of the screen.
- Under Identity Management, download the most recent software that is appropriate for your
platform.
- In the /etc/hosts file, add the FQDN to your system's hostname entry.
The FQDN is the Fully Qualified Domain Name. This name is a combination
of the host name and the administration domain, as in:
192.168.5.5 myhost myhost.example-domain.com
- Install the Directory Server packages.
Answer the questions by using the information from Collect Information for the Directory Server for LDAP.
- Ensure that the Directory Server starts at every boot.
- Add an init.d script.
In the following example, change the SERVER_ROOT and SERVER_INSTANCE variables to match your
installation.
/etc/init.d/ldap.directory-myhost
---------------------------------------
#!/sbin/sh
SERVER_ROOT=/var/Sun/mps
SERVER_INSTANCE=myhost
case "$1" in
start)
${SERVER_ROOT}/slapd-${SERVER_INSTANCE}/start-slapd
;;
stop)
${SERVER_ROOT}/slapd-${SERVER_INSTANCE}/stop-slapd
;;
*)
echo "Usage: $0 { start | stop }"
exit 1
esac
exit 0
- Link the init.d script to the rc2.d directory.
/usr/bin/ln \
/etc/init.d/ldap.directory-myhost \
/etc/rc2.d/S70ldap.directory-myhost
- Verify your installation.
- Examine your installation directory.
A subdirectory that is named slapd-server-hostname must exist.
- Start the Directory Server.
# installation-directory/slapd-server-hostname/restart-slapd
- Verify that the slapd process exists.
# ps -ef | grep slapd
./ns-slapd -D installation-directory/slapd-server-instance -i
installation-directory/slapd-server-instance/
Troubleshooting
For strategies to solve LDAP configuration problems, see Chapter 13, LDAP Troubleshooting (Reference), in System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).
Protect Access Logs for the Sun Java System Directory Server
The LDIF script that this procedure creates sets up the following rules for
access logs:
Log events at log level 256 and create buffered logs (default).
Rotate logs daily.
Keep a maximum of 100 log files, and each file is at most 500 MBytes.
Expire log files that are older than 3 months.
Delete oldest logs if less than 500 MBytes free disk space is available.
All log files use a maximum of 20,000 MBytes of disk space.
- Create a script to manage access logs.
Create a /var/tmp/logs-access.ldif file with the following content:
dn: cn=config
changetype: modify
replace: nsslapd-accesslog-logging-enabled
nsslapd-accesslog-logging-enabled: on
-
replace: nsslapd-accesslog-level
nsslapd-accesslog-level: 256
-
replace: nsslapd-accesslog-logbuffering
nsslapd-accesslog-logbuffering: on
-
replace: nsslapd-accesslog-logrotationtime
nsslapd-accesslog-logrotationtime: 1
-
replace: nsslapd-accesslog-logrotationtimeunit
nsslapd-accesslog-logrotationtimeunit: day
-
replace: nsslapd-accesslog-maxlogsize
nsslapd-accesslog-maxlogsize: 500
-
replace: nsslapd-accesslog-maxlogsperdir
nsslapd-accesslog-maxlogsperdir: 100
-
replace: nsslapd-accesslog-logexpirationtime
nsslapd-accesslog-logexpirationtime: 3
-
replace: nsslapd-accesslog-logexpirationtimeunit
nsslapd-accesslog-logexpirationtimeunit: month
-
replace: nsslapd-accesslog-logmaxdiskspace
nsslapd-accesslog-logmaxdiskspace: 20000
-
replace: nsslapd-accesslog-logminfreediskspace
nsslapd-accesslog-logminfreediskspace: 500
- Run the script.
# ldapmodify -h localhost -D 'cn=directory manager' \ -f /var/tmp/logs-access.ldif
- Type the password.
Enter bind password: Type the appropriate password
modifying entry cn=config
Protect Error Logs for the Sun Java System Directory Server
The LDIF script that this procedure creates sets up the following rules for
the error logs:
Rotate logs weekly.
Keep a maximum of 30 log files, and each file is at most 500 MBytes.
Expire log files that are older than 3 months.
Delete oldest logs if less than 500 MBytes free disk space is available.
All log files use a maximum of 20,000 MBytes of disk space.
- Create a script to manage error logs.
Create a /var/tmp/logs-error.ldif file with the following content:
dn: cn=config
changetype: modify
replace: nsslapd-errorlog-logging-enabled
nsslapd-errorlog-logging-enabled: on
-
replace: nsslapd-errorlog-logexpirationtime
nsslapd-errorlog-logexpirationtime: 3
-
replace: nsslapd-errorlog-logexpirationtimeunit
nsslapd-errorlog-logexpirationtimeunit: month
-
replace: nsslapd-errorlog-logrotationtime
nsslapd-errorlog-logrotationtime: 1
-
replace: nsslapd-errorlog-logrotationtimeunit
nsslapd-errorlog-logrotationtimeunit: week
-
replace: nsslapd-errorlog-maxlogsize
nsslapd-errorlog-maxlogsize: 500
-
replace: nsslapd-errorlog-maxlogsperdir
nsslapd-errorlog-maxlogsperdir: 30
-
replace: nsslapd-errorlog-logmaxdiskspace
nsslapd-errorlog-logmaxdiskspace: 20000
-
replace: nsslapd-errorlog-logminfreediskspace
nsslapd-errorlog-logminfreediskspace: 500
- Run the script.
# ldapmodify -h localhost -D 'cn=directory manager' -f /var/tmp/logs-error.ldif
- Answer the prompts.
Enter bind password: Type the appropriate password
modifying entry cn=config
Configure a Multilevel Port for the Sun Java System Directory Server
To work in Trusted Extensions, the server port of the Directory Server
must be configured as a multilevel port (MLP) in the global zone.
- Start the Solaris Management Console.
# /usr/sbin/smc &
- Select the This Computer (this-host: Scope=Files, Policy=TSOL) toolbox.
- Click System Configuration, then click Computers and Networks.
You are prompted for your password.
- Type the appropriate password.
- Double-click Trusted Network Zones.
- Double-click the global zone.
- Add a multilevel port for the TCP protocol:
- Click Add for the Multilevel Ports for Zone's IP Addresses.
- Type 389 for the port number, and click OK.
- Add a multilevel port for the UDP protocol:
- Click Add for the Multilevel Ports for Zone's IP Addresses.
- Type 389 for the port number.
- Choose the udp protocol, and click OK.
- Click OK to save the settings.
- Update the kernel.
# tnctl -fz /etc/security/tsol/tnzonecfg
Populate the Sun Java System Directory Server
Several LDAP databases have been created or modified to hold Trusted Extensions
data about label configuration, users, and remote systems. In this procedure, you populate the
Directory Server databases with Trusted Extensions information.
- Create a staging area for files that you plan to use to populate
the naming service databases.
# mkdir -p /setup/files
- Copy the sample /etc files into the staging area.
# cd /etc
# cp aliases group networks netmasks protocols /setup/files
# cp rpc services auto_master /setup/files
# cd /etc/security
# cp auth_attr prof_attr exec_attr /setup/files/
#
# cd /etc/security/tsol
# cp tnrhdb tnrhtp /setup/files
If you are running the Solaris 10 11/06 release without patches, copy the ipnodes
file.
# cd /etc/inet
# cp ipnodes /setup/files
- Remove the +auto_master entry from the /setup/files/auto_master file.
- Remove the ?:::::? entry from the /setup/files/auth_attr file.
- Remove the :::: entry from the /setup/files/prof_attr file.
- Create the zone automaps in the staging area.
In the following list of automaps, the first of each pair of
lines shows the name of the file. The second line of each pair
shows the file contents. The zone names identify labels from the default label_encodings
file that is included with the Trusted Extensions software.
/setup/files/auto_home_public
* myNFSserver_FQDN:/zone/public/root/export/home/&
/setup/files/auto_home_internal
* myNFSserver_FQDN:/zone/internal/root/export/home/&
/setup/files/auto_home_needtoknow
* myNFSserver_FQDN:/zone/needtoknow/root/export/home/&
/setup/files/auto_home_restricted
* myNFSserver_FQDN:/zone/restricted/root/export/home/&
- Add every system on the network to the /setup/files/tnrhdb file.
No wildcard mechanism can be used here. The IP address of every system
to be contacted, including the IP addresses of labeled zones, must be
in this file.
- Open the trusted editor and edit /setup/files/tnrhdb.
- Add every IP address on a labeled system in the Trusted Extensions
domain.
Labeled systems are of type cipso. Also, the name of the security template
for labeled systems is cipso. Therefore, in the default configuration, a cipso entry is
similar to the following:
192.168.25.2:cipso
Note - This list includes the IP addresses of global zones and labeled zones.
- Add every unlabeled system with which the domain can communicate.
Unlabeled systems are of type unlabeled. The name of the security template for
unlabeled systems is admin_low. Therefore, in the default configuration, an entry for an
unlabeled system is similar to the following:
192.168.35.2:admin_low
- Save the file, and exit the editor.
- Check the syntax of the file.
# tnchkdb -h /setup/files/tnrhdb
- Fix any errors before continuing.
- Copy the /setup/files/tnrhdb file to the /etc/security/tsol/tnrhdb file.
- Use the ldapaddent command to populate every file in the staging area.
# /usr/sbin/ldapaddent -D "cn=directory manager" \ -w dirmgr123 -a simple -f /setup/files/hosts hosts