OpenSolaris

1. Community: Security
   1. Announcements
   2. News
   3. Blogs
   4. Discussions
   5. Community Projects
      1. Pluggable Authentication Module
      2. Trusted Extensions
         1. History
         2. Trusted Extensions Developer Guide
         3. Installing the Solaris Trusted Extensions Software on a Laptop Computer
         4. Experimental Java Classes for Trusted Extensions Labeling APIs
      3. Secure By Default
         1. Secure by Default Design
      4. Privilege Debugging
      5. RBAC - Role Based Access Control
      6. Auditing
      7. Basic File Privs
      8. Kerberos
      9. Java
      10. SSH
      11. Cryptographic Framework
   6. Library
      1. HOWTO Documents
         1. Privilege Bracketing
      2. Username length
   7. Presentations
   8. Events
   9. Leaders
   10. Observers
   11. Files

OpenSolaris Community: Security

View the leaders for this community
Community Observers

• Cryptographic Framework
  
• Duckwater: Simplified name services management
  
• Fine Grained Access Policy (FGAP)
  
• Fingerprint Authentication
  
• Flexible Mandatory Access Control
  
• Forensic Tools
  
• IPsec Tunnel Reform
  
• Kerberos
  
• Key Management Framework
  
• Labeled IPsec
  
• Network Auto-Magic
  
• OpenSolaris Security Audit
  
• Reno: Login Process Enhancements for Interop
  
• Sparks: name service switch/nscd enhancements
  
• Trusted Platform Module support
  
• Validated Execution Project
  
• Virtual Network Machines
  
• Visual Panels
  
• Winchester: Schema mapping and ID mapping for AD Interoperability
  
• ZFS on disk encryption support
  
• lofi compression & cryptography support
  

What we cover:

Security projects in OpenSolaris: including but not limited to:

• Cryptographic Framework
• IPsec (joint with networking community)
  • kernel extensions to TCP/IP and
  • user programs that control IPsec
• GSS
  • kernel
  • libgss
• Kerberos
  • kernel
  • userland
• SASL
• SSH
• RBAC
• Solaris Auditing
  • libbsm
  • c2audit kernel module
• Trusted Extensions
  • Labeled Networking
  • Label-aware Filesystem Mounting and Sharing
  • Labeled Printing
  • Labeled Desktops
    • Trusted JDS

The technologies themselves and using them in other parts of the system.

• Questions/FAQs/Docs on secure programming for OpenSolaris.

• Place to discuss future/past/present security related changes for OpenSolaris. A place for Sun and the whole OpenSolaris community to share ideas for

improving OpenSolaris security.

The charter does NOT include:

A place to report security bugs/vulnerabilities in the binary Solaris product or other Sun products including the OpenSolaris source.

• For security vulnerability information contact security dash alert at sun dot com for now. In the future we may have an opensolaris.org mail address for this.

We believe in full disclosure, but please don't send security vulnerability information to the security-discuss alias, due to agreements on responsible disclosure with groups such as CERT and other vendors it may be prudent to contact these discussions in a controlled manner with a reduced audience.

We have this process already documented on the SunSolve security pages.

Announcements

31 Jan 2008	UPDATE: Solaris Security Best Practices
02 Nov 2007	New Solaris Security Best Practices
25 Jan 2007	Crypto Project
30 Oct 2006	Trusted Extensions Developer Guide
31 May 2006	Google Summer of Code 2006

News

Network Security Presentation- Shawn Emery | FROSUG Aug 2008 | 08/27/2008

Shawn Emery gave a Network Security presentation at the August 21st meeting to the Front Range OpenSolaris User Group (FROSUG) in Broomfield, CO. Presentation contains info about the Crypto Framework, SASL, Kerberos, PAM, OpenSSl, Java, IPsec/IKE, and SSH.

Cryptographic Framework - Wolfgang Ley | OSDevCon 2008 - Prague | 06/26/2008

Presentation of the Cryptographic Framework by Wolfgang Ley at the OpenSolaris Developer Conference in Prague. Click on the link to see a video of the presentation, the slides, and a paper.

Multilevel Filesystems in Solaris Trusted Extensions | opensolaris.org | 07/21/2007

Glenn Faden presented a paper about the Multilevel Filesystems in Solaris Trusted Extensions at the 12th ACM symposium on Access control models and technologies. The paper is available at http://doi.acm.org/10.1145/1266840.1266859 or for your convenience, here: http://opensolaris.org/os/community/security/projects/tx/sacmat04s-faden-1.pdf

Comparitive Study of Containment Technologies | opensolaris.org | 06/14/2007

An interesting paper has been written by two Computer Science students, Magnus Eriksson and Staffan Palmroos, for their final thesis at Linköpings University in Sweden. The paper compares the use of Solaris zones, and SELinux Type Enforcement in implementing containment strategies. It explains the architectural elements of each system, and describes their experiences in deploying confined applications.

Google Summer of Code 2006 Results | opensolaris.org | 10/17/2006

The Google Summer of Code for 2006 has finished now and a copy of Johannes Nicolai's report is in the security community along with pointers to webrev's of the code changes.

Blogs

bubbva - What on earth are the credit card companies up to?

Nov 14, 2:46 PM

I've heard a lot of cautionary advice over the last few weeks about watching the mail for updates to credit card agreements and that the credit card companies were doing a lot of sneaky tricks to ...

gbrunett - NEW: Solaris 10 Security Deep Dive Presentation

Nov 14, 10:12 AM

It must be that time of year again. At Sun's Customer Engineering Conference this year, I unveiled the latest update to my Solaris 10 Security Deep Dive Presentation . This version has been updated ...

bubbva - Neil Young and the Linc Volt in Menlo Park!

Nov 11, 3:28 PM

Neil Young brought his Linc Volt , reconditioned classic 1959 Lincoln Continental Mk IV, to Sun's Menlo Park campus today to give employees a chance to see the car and the singer up close. The car is ...

bubbva - Voting

Nov 4, 10:23 AM

I got myself to my polling place around 9AM this morning, finding it a bustle of activity, but no real lines.  California is trying to really push voting-by-mail and if your polling place does not ...

wfiveash - How to configure advanced kadmind logging in Solaris

Nov 3, 2:43 PM

After some experimenting and looking at source I've determined that the kadmind does have support for rotating its own log that is separate from the krb5kdc log (by default the kadmind logs to the ...