Hardening - Setting Solaris 11 Security Settings using the compliance command

The  compliance program produces security assessments and reports. Essentially an evaluation of the security  configuration  of  a system, conducted against a benchmark.

No more having a list of things you have to check and having to follow some doc to implement the settings. The compliance command makes things easy peasy.

If you don't find the compliance command, install pkg:/security/compliance.

First off, list the assessments available.

# compliance list -p
Benchmarks:
pci-dss:        Solaris_PCI-DSS
solaris:        Baseline, Recommended
Assessments:
        No assessments available

I recommend running the solaris Recommended check (if you've got cardholder information on your system, you'll need to be doing the pci-dss check instead).

compliance assess -b solaris -p Recommended
compliance report -a solaris.Recommended.2016-09-05,15:33

This outputs an html file that I usually mail myself. If you rock a GUI, then just view the html file in a browser.

Tadaaa! You now have a document that not only tells you what needs to be done - but also how to do it. And when everything in your report is green - now you have a report to forward onto the relevant people.

---

Some of you will end up with reports with some red in it because there are settings you don't want to/can't  change. For example, on the SuperCluster, you're going to need NFS to access your storage. Luckily compliance gives you the ability to customise its assessments.

First list the rules we want to exclude:

Service svc:/network/nfs/status is disabled or not installed OSC-40010

Service svc:/network/nfs/nlockmgr is disabled or not installed OSC-38510

Service svc:/network/nfs/server is disabled or not installed OSC-39510

Service svc:/network/nfs/rquota is disabled or not installed OSC-39010

Service svc:/network/nfs/cbd is disabled or not installed OSC-37010

Service svc:/network/nfs/mapid is disabled or not installed OSC-38010

ssh(1) is the only service binding a listener to non-loopback addresses OSC-73505

Next we create a custom assessment:

compliance tailor -t MySecurityPolicy 'set benchmark=solaris; set profile=Recommended; exclude OSC-40010; exclude OSC-38510; exclude OSC-39510; exclude OSC-39010; exclude OSC-37010; exclude OSC-38010; exclude OSC-73505; export'

You can, of course, use "include" if you needed to.

And then we run our custom security assessment:

compliance assess -t MySecurityPolicy
compliance report -a yadayadayada 

And that's it folks, I went a step further and wrote a script to output the commands I need to implement the hardening, but I'm tired of writing this post. It's getting too long so here it ends.

SuperCluster DR Procedure for App Zones

NOTE: This is a procedure for testing failing over from one SuperCluster to another at a different site - not for the occurrence of an actual DR situation.

This doc is a work in progress - process is still a bit finicky

Pre-work

i) Set up zfs replication isci zone lun and nfs shares

ii) Make sure zone root zpool has different name on source and destination system

iii) Add same IB IP as zfs-sa at source to zfs-sa at destination

iv) Set up key authentication to zfs-sa at destination
v) Create script at source to periodically save zone configs

1. Snap ZFS pool

2. Snap zfs project/shares

3. Share zpool lun

On DR:

a. Create a project to put your clones under

b. List the snapshots on the zpool lun

c. Create the clone off the appropriate snap

4. Share zfs projects/shares

Do this in the GUI, for each project:

- click on Shares

- underneath Shares click on Projects

- underneath Projects click on Replica

- move the mouse over the relevant project and a pencil and trash bin icon will show on the right, click on the pencil

- Click on Replication

- below Replication should be a bunch of icons

- click on the + icon ("Clone most recently received project snapshot")

-  You might get an error at this point. Just try again and again.

- When you get to the screen asking for new project name, use the current project name and add "_DR" and click on Continue.

Or in an actual DR situation:

Instead of the + icon, you break replication. Afterwards you will need to reverse replication before failing back.

5. Import zpool

On destination server:

cfgadm -alv

devfsadm -Cv

zpool import -R / zones

6. Recreate zone

Configure zones

Attach zones

Boot zones

Copying a SuperCluster Zone

1. Snapshot the original zone

zfs snapshot -r zones/zone1@copy

2. Copy the snap across to the destination zoneroot

zfs send -vr zones/zone1@copy | zfs recv -v zones/zone2

3. Export the zone config and copy it across to the new zone. (use IB if possible)

4. Edit the zone config to reflect new address and new zonepath

5. Create the new zone

6. Attach and boot the new zone

7. Configure the new zone

Name

Solaris 11

sysconfig create-profile -g identity -o config.xml

sysconfig configure -g identity -c config.xml

Solaris 10

Sysunconfig

Edit /etc/nodename, /etc/hostname.*, /etc/hosts

Host files

vi /etc/hosts

IP

Solaris 11

ipadm delete-addr ipmp0/v4

ipadm delete-addr ipmp1/v4

ipadm create-addr -T static -a 23.88.34.157/24 ipmp0

ipadm create-addr -T static -a 192.168.55.61/22 ipmp1

ipadm set-ifprop -p standby=on -m ip net2

route -p add default 23.88.34.1

Solaris 10

vi /etc/hostname.*

vi /etc/defaultrouter

reboot

Samba config

vi /etc/samba/smb.conf

net join -U user -S ADservername

rm /export/home/samba/*/.ssh/known_hosts

Reboot

8. Configure the storage from the ZFS

Log into the appropriate zfs head:

Shares -> Projects: Add new project

Edit Project:

Under General set Mountpoint to /export/projectname

Under protocols:

Share mode=none

Add NFS Exception: Network - IB IP of zone/32 - Read/write - tick root access

Under shares, add shares needed

Go into each share and set quota

vi /etc/vfstab

mount -a

Change ownership of each mountpoint

9. Put key authentication into place between original and copy.

10. Rsync the NFS shares from original to new zone

rsync -azh /u01 192.168.55.61:/

Setting up Samba Auditing

1. Define the output file

  vi /etc/syslog.conf and add the line:

local5.notice                                   /var/log/samba/audit.log

  Note: Use tabs for spacing!

2. Make sure the output file is rotated

logadm -A 6w -S5g -z 0 -c -p 1w -w /var/log/samba/audit.log

Where:

                        -A 6w means Delete files older than 6 weeks

                        -S 5g means delete files so that all versions are less than 5g

                        -z 0 means compress all previous versions

                        -c mean rotate copying & truncating the logfile to zero length, rather than renaming

                        -p 1w means rotate after 1 week

-w means write to settings to logadm.conf

3. Change the samba settings for the shares.

  vi /etc/samba/smb.conf

  To the [global] section add the lines:

        full_audit:prefix = %U|%I|%u|%S

        full_audit:failure = connect

        full_audit:success = connect disconnect mkdir rmdir read pread write pwrite sendfile rename unlink chmod fchmod chown fchown ftruncate lock symlink readlink link mknod

        full_audit:facility = LOCAL5

        full_audit:priority = notice

  For each of the shares you want to audit, add the line:

        vfs object = full_audit

  Note: If you want to audit all shares, add this line to the global section.

  In case you're wondering what file creates and deletes show up in the log as:
    create=pwrite

    delete=unlink

4. svcadm restart samba

Test Solaris Root Mirror

Here's the situation. Being the good UNIX SysAdmin that you are, one of the first things you do is mirror the rootpool. You do something like:

zpool attach -f rpool c0t5000CCA03C5A7C00d0 c0t5000CCA03C5C19CCd0

...wait for the mirror to finish resilvering...

installboot -f -F zfs /usr/platform/`uname -i`/lib/fs/zfs/bootblk /dev/rdsk/c0t5000CCA03C5C19CCd0

(or better use - see comments below for why - :bootadm install-bootloader)

(Notice that my disk devices don't use slices - there'd be an "s0" at the end of the disk names - older ZFS systems needed to the root disk to be on a slice - this has fallen away)

So to test that you boot off the root disk - you go to ok prompt and try to boot off the second disk

shutdown -y -i0 -g0
...
ok> boot disk1
Boot device: /pci@3c0/pci@1/pci@0/pci@2/scsi@0/disk@p0  File and args:
ERROR: /packages/deblocker: Last Trap: Fast Data Access MMU Miss

So that's a bit of a bitch. Luckily, this is only a test. Start up your machine normally and then shut down with an init 0. Somehow rebooting with an init, sorts this out.

(If it wasn't a test, you can try to specify the path old school. Your path you can figure out - though I've had hit and miss success - by running devalias and scsi-probe-all and doing a path similar to /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca02584ad19,0:a. - Sidenote: If that doesn't work I've had limited success by adding a to the last number before the comma).

Either way, once you've got a booted system. You can check which disk you're booted from by running prtconf -vp |grep bootpath.

This post is a little neither here nor there - but that's because my testing has brought various results and was done whil I was changing from a sas root disk to an ssd root disk. I'll update it as I retest.

VLAN tagging in Solaris

If you want to have zones in multiple subnets but using the same physical port, you have to use VLAN tagging. VLAN tagging is pretty easy to configure on the zones (point 7), less so on the global zone.

1. The Network guys have to do a few things for you:
• set the network ports your nic connects to as "trunked"
• give you the vlan id of the vlans you want to connect to (digits)
• for aggregated NICs, set LACP to active (rather than auto)
• set the default vlan-id of the ports to 1 
2. NOTE: Configuring the ports as trunked, obsoletes any traffic that isn't vlan tagged. All or nothing baby. 
3. Your aggregate needs LACP activity to be active
• dladm modify-aggr -L active -T short aggr0
4. I use aggregates, but I think most of the same steps below applies for IPMP.
5. I wish you could add a default vlan ID to the aggregate when you create it but you can't (and I get the feeling if I think really hard about it, I'll be able to see the logic in why). Instead you have to create a vnic on the aggregate that uses that vlan ID:
• dladm create-vnic -v 10 -l aggr0 vnic10
6. Now create an address on that vnic
• ipadm create-ip vnic10
• ipadm create-addr -T static -a 196.0.10.15/24 vnic10
7. That sorts out the global zone. For the zones its pretty easy. Just set the vlan-id attribute (under anet) on the zone config.

NOTES:

• The active LACP is not something I'm sure needs to be there but it worked so I'm leaving it.
• IPMP in zones - if I recall correctly - needs vnics created for you to do IPMP within the zone. Just make sure you assign the correct vlan ID to those vnics and you should be fine.

Solaris 11.2 breaks my zpool import of clone with missing cache disk

1.       Assign disks to machine

root@prodmachine:~# sanlun lun show |grep zpooltest

zamgnasvm01          /vol/unixprod_vol99_zpooltest/unixprod_vol99_zpooltest_data01  /dev/rdsk/c0t600A0980383034716124465434593156d0s2 qlc3       FCP        1g      C

zamgnasvm01          /vol/unixprod_vol99_zpooltest/unixprod_vol99_zpooltest_data02  /dev/rdsk/c0t600A0980383034716124465434593157d0s2 qlc2       FCP        1g      C

zamgnasvm01          /vol/unixprod_vol99_zpooltest/unixprod_vol99_zpooltest_log01   /dev/rdsk/c0t600A0980383034716124465434593158d0s2 qlc2       FCP        1g      C

zamgnasvm01          /vol/unixprod_vol99_zpooltest/unixprod_vol99_zpooltest_cache01 /dev/rdsk/c0t600A0980383034716124465434593159d0s2 qlc1       FCP        1g      C

root@prodmachine:~#

2.       Create a zpool

root@prodmachine:~# zpool status zpooltest

  pool: zpooltest

 state: ONLINE

  scan: none requested

config:

        NAME                                       STATE     READ WRITE CKSUM

        zpooltest                                  ONLINE       0     0     0

          mirror-0                                 ONLINE       0     0     0

            c0t600A0980383034716124465434593156d0  ONLINE       0     0     0

            c0t600A0980383034716124465434593157d0  ONLINE       0     0     0

        logs

          c0t600A0980383034716124465434593158d0    ONLINE       0     0     0

        cache

          c0t600A0980383034716124465434593159d0    ONLINE       0     0     0

errors: No known data errors

root@prodmachine:~#

3.       Use SAN replication to replicate disks to remote machine

4.       Check remote machine’s BE

root@drmachine:~# beadm list

BE                 Active Mountpoint Space  Policy Created

--                 ------ ---------- -----  ------ -------

solaris-5          -      -          53.83M static 2014-07-08 12:43

solaris-5-backup-1 NR     /          11.78G static 2014-10-13 14:34

solaris-7          -      -          15.05G static 2015-02-26 14:43

solaris-8          -      -          1.77G  static 2015-04-08 10:39

root@drmachine:~# pkg list entire

NAME (PUBLISHER)                                  VERSION                    IFO

entire                                            0.5.11-0.175.1.19.0.6.0    i--

root@drmachine:~#

5.       Only assign the data lun (i.e. no mirror, no log, no cache)

root@drmachine:~# sanlun lun show |grep zpooltest

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_data01 /dev/rdsk/c0t600A0980443355634D3F46644573306Fd0s2 qlc2       FCP        1g      C

root@drmachine:~#

6.       Import the pool (with –f and –m options) RESULT: SUCCESS

root@drmachine:~# zpool import -R / -f -m zpooltest

root@drmachine:~# zpool status zpooltest

  pool: zpooltest

 state: DEGRADED

status: One or more devices are unavailable in response to persistent errors.

        Sufficient replicas exist for the pool to continue functioning in a

        degraded state.

action: Determine if the device needs to be replaced, and clear the errors

        using 'zpool clear' or 'fmadm repaired', or replace the device

        with 'zpool replace'.

        Run 'zpool status -v' to see device specific details.

  scan: none requested

config:

        NAME                                       STATE     READ WRITE CKSUM

        zpooltest                                  DEGRADED     0     0     0

          mirror-0                                 DEGRADED     0     0     0

            c0t600A0980443355634D3F46644573306Fd0  ONLINE       0     0     0

            4167588681570226322                    UNAVAIL      0     0     0

        logs

          16316075685438834122                     UNAVAIL      0     0     0

        cache

          c0t600A0980383034716124465434593159d0    UNAVAIL      0     0     0

errors: No known data errors

root@drmachine:~#

7.       Change to different BE and reboot

root@drmachine:~# beadm activate solaris-7

root@drmachine:~# init 6

…

root@drmachine:~# beadm list

BE                 Active Mountpoint Space   Policy Created

--                 ------ ---------- -----   ------ -------

solaris-5          -      -          53.83M  static 2014-07-08 12:43

solaris-5-backup-1 -      -          1.45G   static 2014-10-13 14:34

solaris-7          NR     /          25.94G  static 2015-02-26 14:43

solaris-8          -      -          1.77G   static 2015-04-08 10:39

root@drmachine:~# pkg list entire

NAME (PUBLISHER)                                  VERSION                    IFO

entire                                            0.5.11-0.175.2.5.0.5.0     i--

root@drmachine:~#

8.       Import the pool (with –f and –m) RESULT: FAILURE

root@drmachine:~# zpool import -R / -f -m zpooltest

cannot import 'zpooltest': one or more devices is currently unavailable

root@drmachine:~#

9.       Assign the mirror disk to the machine and retry import RESULT: FAILURE

root@drmachine:~# sanlun lun show

controller(7mode)/                                                                                          device                                            host                  lun

vserver(Cmode)       lun-pathname                                                                           filename                                          adapter    protocol   size    mode

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_data01 /dev/rdsk/c0t600A0980443355634D3F46644573306Fd0s2 qlc2       FCP        1g      C

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_data02 /dev/rdsk/c0t600A0980443355634D3F466445733070d0s2 qlc0       FCP        1g      C

root@drmachine:~# zpool import -R / -f -m zpooltest

cannot import 'zpooltest': one or more devices is currently unavailable

root@drmachine:~#

10.   Assign the log device disk to the machine and retry import RESULT: SUCCESS

root@drmachine:~# sanlun lun show

controller(7mode)/                                                                                          device                                            host                  lun

vserver(Cmode)       lun-pathname                                                                           filename                                          adapter    protocol   size    mode

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_data01 /dev/rdsk/c0t600A0980443355634D3F46644573306Fd0s2 qlc2       FCP        1g      C

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_data02 /dev/rdsk/c0t600A0980443355634D3F466445733070d0s2 qlc0       FCP        1g      C

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_log01  /dev/rdsk/c0t600A0980443355634D3F466445733071d0s2 qlc0       FCP        1g      C

root@drmachine:~# zpool import -R / -f -m zpooltest

root@drmachine:~#

11.    Export  the zpool, unassign the log device and assign the cache device disk to the machine and retry import. RESULT: FAILURE

root@drmachine:~# sanlun lun show

controller(7mode)/                                                                                           device                                            host                  lun

vserver(Cmode)       lun-pathname                                                                            filename                                          adapter    protocol   size    mode

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_data01  /dev/rdsk/c0t600A0980443355634D3F46644573306Fd0s2 qlc2       FCP        1g      C

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_data02  /dev/rdsk/c0t600A0980443355634D3F466445733070d0s2 qlc0       FCP        1g      C

zamgnasvmdr01        /vol/zamgnasvm01_unixprod_vol99_zpooltest_mirror_CLONE/unixprod_vol99_zpooltest_cache01 /dev/rdsk/c0t600A0980443355634D3F466445733072d0s2 qlc0       FCP        1g      C

root@drmachine:~# zpool import -R / -f -m zpooltest

cannot import 'zpooltest': one or more devices is currently unavailable

root@drmachine:~#

Got a call logged with Oracle to sort this out. Fixed with Solaris 11.3.