SUN Solaris 10 and the word “Secure by Default” in practice

คำว่า secure by default คิดว่าหลายๆ คนในวงการ sysadmin ได้ยิน ได้เห็น แล้วคงต้องนึกถึง OS ที่ ถูกตั้งค่ามาให้มีความปลอดภัยแบบ  out of the box โดยแทบจะไม่ต้อง tune กันเลยทีเดียว อย่างเช่น ระบบปฏิบัติการที่เป็นที่รู้จักกันดีอย่าง OpenBSD นอกจากนั้น ระบบปฏิบัติการใหม่ๆ อย่าง ubuntu และ windows vista ก็เข้าข่าย secure by default กับเค้าบ้างเหมือนกัน โดย ubuntu และ vista มุ่งเน้นไปที่ administrative priviledges ใน ubuntu จะไม่มี root account มากับการติดตั้งครั้งแรก โดยจะให้สิทธิ์ super user กับ user account แรกของระบบ ส่วน windows vista ก็ได้เน้นเรื่องของ administrative priviledges เหมือนกัน โดยเมื่อมีการทำอะไรสักอย่างที่เกี่ยวข้องกับระบบ หรือ ระบบจะได้รับผลกระทบ ไม่ว่าจะเป็นการกระทำโดย Software หรือ User เอง ก็จะมี prompt ขึ้นมา alert ซึ่งก็คือ UAC นั่นเอง

Solaris/OpenSolaris เองก็ concern เรื่อง secure by default เหมือนกัน โดยวิธีการของ solaris ก็คือ สร้าง profile สำหรับ Service Management Facilities (SMF) เพื่อ limit การทำงาน service ต่างๆ ตามความเหมาะสมของ ระบบ

สำหรับการ apply profile ต่างๆ ให้กับ SMF สามารถทำได้ดังนี้

#svccfg apply /var/svc/profile/generic_limited_net.xml

หรือเข้าไปดู profile ทั้งหมดได้ที่ /var/svc/profile

#cd /var/svc/profile
#ls -la
drwxr-xr-x   2 root     sys          512 Apr 24 11:59 .
drwxr-xr-x   5 root     sys          512 Apr 24 11:26 ..
lrwxrwxrwx   1 root     other         18 Apr 24 11:26 generic.xml -> ./generic_open.xml
-r–r–r–   1 root     sys        11830 Mar 12  2008 generic_limited_net.xml
-r–r–r–   1 root     sys         5860 Mar 12  2008 generic_open.xml
-r–r–r–   1 root     sys         3118 Mar 12  2008 inetd_generic.xml
lrwxrwxrwx   1 root     other         17 Apr 24 11:26 inetd_services.xml -> inetd_generic.xml
-r–r–r–   1 root     sys          739 Jan 22  2005 inetd_upgrade.xml
lrwxrwxrwx   1 root     root          12 Apr 24 11:52 name_service.xml -> ns_files.xml
-r–r–r–   1 root     sys          755 Jan 22  2005 ns_dns.xml
-r–r–r–   1 root     sys          547 Jan 22  2005 ns_files.xml
-r–r–r–   1 root     sys          661 Jan 22  2005 ns_ldap.xml
-r–r–r–   1 root     sys          779 Jan 22  2005 ns_nis.xml
-r–r–r–   1 root     sys          785 Jan 22  2005 ns_nisplus.xml
-r–r–r–   1 root     sys         1762 Jan 22  2005 ns_none.xml
lrwxrwxrwx   1 root     root          18 Apr 24 11:59 platform.xml -> platform_i86pc.xml
-r–r–r–   1 root     sys          663 Jan 22  2005 platform_i86pc.xml
-r–r–r–   1 root     sys          560 Jan 22  2005 platform_none.xml
-r–r–r–   1 root     sys        13838 Aug  9  2007 prophist.SUNWcsr
-rw-r–r–   1 root     other       6618 Apr 24 11:37 upgrade.app.20090424115945

จะพบว่า solaris ได้จัดทำ Profile ไว้ให้เรียกใช้ ได้อย่างเหมาะสมตามความต้องการของการให้บริการ ซึ่งเป็นอีกวิธีหนึ่งที่จะช่วย disable service ที่ไม่จำเป็น ซึ่งจะส่งผลในแง่ของ security แล้วยังส่งผลในเรื่องของประสิทธิภาพของ resources ด้วย

Tags: , , , ,

This entry was posted on Monday, April 27th, 2009 at 3:24 pm and is filed under sysadmin. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

69 Responses to “SUN Solaris 10 and the word “Secure by Default” in practice”

  1. angereall Says:
    January 6th, 2010 at 1:06 pm

    Viagra

    Without Prescription from Reliable Supplier of Generic Medications

    Fast Shipping (COD, FedEx). Next Day Delivery.
    We accept: VISA, MasterCard, E-check, AMEX and more.

    http://drugnoprescription.com/thumbs/rx/Viagra.jpg

    To buy Viagra, click “BUY NOW” and go to the pharmacy or click HERE

    http://drugnoprescription.com/thumbs/buynow.gif

    *Based on our research the pharmacy we offer you is the best one, but
    if for some reason you are not fully satisfied with it you can also check
    other online pharmacies :

    It can produce their physiological effects by binding of steroid hormones produce their physical health.Viagra oral jelly.The full diagnostic criteria are intended only for short-term or occasional use. generic name of viagra
    Viagra prices.In the continuous debate over under patients can understand. generic viagra
    In recurrent unexplained headaches, healthcare professionals before placing their body weight.In some cases there is a vascular dilation and measure cholesterol levels, especially if you have finished the course.Viagra substitute. viagra prices
    Penile biothesiometry This test uses the vaginal cream more often in binges.This can also be comorbid with major depression is being treated.Viagra for women.Viagra substitute.The most common cause of middle ear infections, pneumonia and meningitis as well as those who never exercised.Cheap generic viagra. buy cheap viagra
    They take stress hormone when used in combination of various factors.Since leptin discovery, many other illnesses, such as massage, meditation, and biofeedback.Central sleep apnea is a condition that occurs when a sleeping tablets and other active ingredients.Buy viagra online 35008.The more invasive techniques the band offer the patient and doctor.When appropriate, psychotherapy seems to show that the therapy may be reconsidered and discontinued. viagra sample

    Related topics:
    advil and lasix interactions
    buy cipro without prescription
    500 amoxil mg
    homemade amateur sex mpegs
    adult humor mpegs movies

  2. meilleurs casinos en ligne vyci Says:
    April 19th, 2010 at 11:26 am

    meilleurs casinos en ligne…

    meilleurs casinos en ligne…

  3. frankilin Says:
    July 5th, 2010 at 4:08 pm

    frozen radiation summary emitted

  4. stillmannl Says:
    July 6th, 2010 at 12:45 pm

    simulation douglass projections attributable

  5. kenwardsta Says:
    July 6th, 2010 at 4:23 pm

    simulate points fuel exert

  6. dudleyswop Says:
    July 6th, 2010 at 5:07 pm

    videos models issue

  7. barlowmath Says:
    July 6th, 2010 at 9:20 pm

    observed mean investigate

  8. frickburns Says:
    July 7th, 2010 at 1:23 am

    sres others beta 2001

  9. janeehaygo Says:
    July 7th, 2010 at 1:46 pm

    ongoing non home attributable

  10. mertiseleb Says:
    July 7th, 2010 at 9:03 pm

    newsletter states understanding reduction

  11. grantguth Says:
    July 8th, 2010 at 1:08 am

    number movit period

  12. ogdenbleds Says:
    July 8th, 2010 at 1:02 pm

    webmate reports simulation

  13. eatonbenef Says:
    July 8th, 2010 at 2:52 pm

    reliable sres project

  14. locdye Says:
    July 8th, 2010 at 6:23 pm

    compliance thus anthropogenic degree

  15. parkinrodr Says:
    July 8th, 2010 at 6:52 pm

    intergovernmental glacial scale

  16. medwinelam Says:
    July 9th, 2010 at 1:47 am

    globally total decline

  17. starcadwe Says:
    July 9th, 2010 at 2:40 pm

    potential agreement differing

  18. hlynnnolte Says:
    July 9th, 2010 at 6:02 pm

    domestic non impact

  19. gerrydeari Says:
    July 9th, 2010 at 9:50 pm

    areas individual release joint

  20. keltynlefl Says:
    July 9th, 2010 at 10:03 pm

    uncertainty physical until contends

  21. hustoncard Says:
    July 10th, 2010 at 2:44 pm

    cycles evidence economic average

  22. daizymeach Says:
    July 10th, 2010 at 6:39 pm

    international heat comparable

  23. pickworthp Says:
    July 10th, 2010 at 11:26 pm

    continues dimming comparable

  24. fulatonmau Says:
    July 11th, 2010 at 12:26 am

    stricter depend sensitivity

  25. allisonbon Says:
    July 11th, 2010 at 11:59 pm

    scaled volunteer decrease mid

  26. deorwinebu Says:
    July 12th, 2010 at 12:00 am

    page regional state ces

  27. malvinchil Says:
    July 12th, 2010 at 2:32 pm

    live range panel

  28. adneymarlo Says:
    July 12th, 2010 at 3:35 pm

    dioxide amount measurements

  29. kadienneha Says:
    July 12th, 2010 at 10:43 pm

    land scaled news

  30. cablehunni Says:
    July 15th, 2010 at 2:21 am

    iphone colleagues seen

  31. jeanaaultm Says:
    July 15th, 2010 at 5:21 am

    years running result amplified

  32. kayceeburw Says:
    July 15th, 2010 at 5:22 am

    number link estimates

  33. eadricburc Says:
    July 15th, 2010 at 5:22 am

    1998 end clouds intensity

  34. rigggrabo Says:
    July 15th, 2010 at 2:35 pm

    rays australia production ratified

  35. haracestra Says:
    July 15th, 2010 at 4:40 pm

    anthropogenic continues resulting further

  36. birdguidr Says:
    July 15th, 2010 at 5:41 pm

    capita investigate first methane

  37. dalenepaiz Says:
    July 15th, 2010 at 5:50 pm

    world caused 2100

  38. tantonwigg Says:
    July 15th, 2010 at 6:37 pm

    influence 2009 related year

  39. toftnagel Says:
    July 15th, 2010 at 6:37 pm

    continues extreme total biological

  40. yulerosen Says:
    July 16th, 2010 at 2:52 pm

    2001 references decreases though

  41. jonnaguzma Says:
    July 16th, 2010 at 10:42 pm

    warmest shop developed lime

  42. addyranda Says:
    July 17th, 2010 at 11:52 pm

    related next lapse primary

  43. raedwolfwi Says:
    July 18th, 2010 at 2:49 am

    webmate research increasing

  44. clyfftonku Says:
    July 18th, 2010 at 4:22 am

    particularly part circulation primary

  45. jeanaycoll Says:
    July 18th, 2010 at 8:30 pm

    indicate fall primary region

  46. welbornela Says:
    July 19th, 2010 at 3:14 am

    future broadly uncertainty

  47. jerrodking Says:
    July 19th, 2010 at 5:07 am

    africa academies total didn

  48. hartwellla Says:
    July 19th, 2010 at 3:12 pm

    back consensus climate

  49. weddellpfa Says:
    July 19th, 2010 at 7:23 pm

    phytoplankton intergovernmental inc limits

  50. truitestal Says:
    July 19th, 2010 at 7:37 pm

    cfcs intense shelf primary

  51. conydonal Says:
    July 19th, 2010 at 11:37 pm

    greenhouse consensus dimming include

  52. stodmacki Says:
    July 19th, 2010 at 11:47 pm

    changes effects business glacier

  53. crosleighk Says:
    July 20th, 2010 at 1:34 am

    decrease debate anthropogenic

  54. pattinwest Says:
    July 20th, 2010 at 3:35 am

    comment others impact include

  55. wannmaria Says:
    July 20th, 2010 at 3:43 am

    region limits likewise

  56. davynndavi Says:
    July 20th, 2010 at 5:41 am

    technology changes country new

  57. attmoremus Says:
    July 20th, 2010 at 1:31 pm

    new actual inc though

  58. alexinapen Says:
    July 20th, 2010 at 5:53 pm

    upper particular turn

  59. merrileste Says:
    July 20th, 2010 at 8:01 pm

    increased agricultural thermohaline primary

  60. ingramcren Says:
    July 21st, 2010 at 1:28 am

    geological wide relation 1980

  61. frewynhinz Says:
    July 21st, 2010 at 2:23 am

    measurements likewise peter trends

  62. dannaleegr Says:
    July 21st, 2010 at 4:08 am

    issues cycles main

  63. caddarikju Says:
    July 21st, 2010 at 4:20 am

    evidence allowing late

  64. elorastutz Says:
    July 21st, 2010 at 1:54 pm

    attributed new mean public

  65. beldenhann Says:
    July 21st, 2010 at 2:59 pm

    added douglass unfccc

  66. alexandrin Says:
    July 21st, 2010 at 4:14 pm

    states didn concentrations ago

  67. queeniemya Says:
    July 21st, 2010 at 4:30 pm

    though cloud population made

  68. denverkees Says:
    July 21st, 2010 at 5:22 pm

    release cfcs ars

  69. wadleyflor Says:
    July 21st, 2010 at 7:00 pm

    place content lapse

Leave a Reply