Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts

Thursday, November 10, 2011

First impressions of Solaris 11 11/11

I have had a few hours to try the final Solaris 11 release, overall I think it is far more stable and polished than the previous "Early Adaptors" release. Besides the fact that I am unable to use semi-old SPARC gear to test the release since only the latest generations of hardware are supported I have found few real problem so far.

The new packaging system finally fixes what I believe have been the biggest problem for Solaris the last five years or so, it is now repository based and it is simple to install software and dependencies are automatically solved. No more hassle of downloading and installing multiple software packages from SunFreeware to resolve dependencies. This also makes packaging faster and safer, brining the whole system to a known level and always with a safe recover option since it is used in conjunction with ZFS clones.

Zones are a fantastic tool for security/workload separation and virtualization so it's good to see that so many enhancements have been done in this area. The perhaps most noticeable is of corse that they now also use the new IPS system for packages and that makes a vanilla zones very lightweight without the hassle of a sparse zone. NFS service can now finally be provided from inside a zone. There is a tight integration with the new crossbow network virtualization making is possible to limit bandwidth to zones, use DHCP in a zone without having a separate NIC and build internal networks between zones inside a single Solaris 11 instance.

Imagine the power and flexibility of an T4-4 with 256 CPU threads and 1TB of memory running 50 zones with several high bandwidth/low latency networks inside the machine with no latency or overhead caused by virtualization.

Unfortunately the X86 version with the graphical desktop seems to be somewhat unstable compared to the Express release, I think it's related to the upgrade of the X server. I have been unable to use my laptop with to displays with the final release.

Solaris 11 is however focused on usage in servers and it seems stable for that, I have only found one disturbing problem so far, sharing ZFS filesystems does not seem to work ( zfs set -o sharenfs=on), but you can share each individual filesystem with the share command. Sadly if you are evaluating this you will probably have to wait until next year when there is a full release of Solaris since no updates are provided without a service contract. If you work for Oracle this is something you might want to fix for everyone, or tell me what I'm doing wrong.

Solaris 11 have many other new features such as per-user encryption of home directories with ZFS crypto, a new mirror/raidz hybrid bloc allocator for ZFS, numerous security enhancements among other thinks. I have only named a few of the changes I will probably keep posting Solaris 11 stuff as I find something interesting that is not directly highlighted it Oracle own what's new documents.

Update: As pointed out in the comments sharing of NFS together with ZFS works a bit differently now. If you share an existing dataset you have to set the share property. However if you set the sharenfs property when creating the dataset it works as in previous versions of Solaris 11 Express, OpenSolaris etc. Move information available in the documentation here.

Tuesday, November 30, 2010

ZFS encryption at ${HOME}

A nice addition to easily use of ZFS encryption for home directories will be available in a future version of Solaris 11. This will allow you to have your password as key for your home dataset which is automatically used at login:

"For users with local ZFS storage we want to provide a very simple and as transparent as possible way of using encrypted ZFS datasets. The target for this is laptops and systems with local ZFS storage for the users home directory.

The goal is to provide as seemless as possible a way to have an encrypted home directory and additional encrypted datasets below the home directory. A new PAM module pam_zfs_key.so will be introduced. This module supports only pam_sm_setcred(3PAM) and pam_sm_chauthtok(3PAM), pam_sm_authenticate(3PAM) is provided but always returns PAM_IGNORE.

It assumes that the users login passphrase is also the passphrase used to protect thier ZFS encrypted home directory and will ensure that when users change their password the passphrase used for deriving the wrapping key for their encrypted ZFS home directory is changed as well."


Bugid: 6983112

Friday, November 19, 2010

Oracle blogs on S11 Express features

Lots of Solaris 11 information have been made available after the launch of Solaris 11 Express, including technical blog entries from Solaris engineers. Here are links to the ones I found most interesting:

Darren Moffat on ZFS crypto:
Introducing ZFS crypto in Oracle Solaris 11 Express
Choosing a value for the ZFS encryption property
Assured delete with ZFS dataset encryption
Having my secured cake and Cloning it too (aka Encryption + Dedup with ZFS)
ZFS encryption what is on disk ?

The Observatory:
Upgrading from OpenSolaris 2009.06 to Solaris 11 Express 2010.11

Alan Coopersmith on X11:
X11 changes in the 2010.11 release

Another great resource for Solaris 11 is the Oracle video blog which now hosts the following videos:
  • New Security Features in Oracle Solaris 11 Express
  • ZFS Features in Oracle Solaris 11 Express
  • Solaris 11 Engineering Panel at LISA 10
  • What's Great in Solaris 11 Express for Sysadmins
  • Solaris 11 Packaging & Installation
  • What's Great in Solaris 11 Express for Developers
  • DTrace BoF at LISA10
  • Oracle Solaris Studio and Oracle Solaris 11 Express
  • Solaris 11 Express: Zones

Several of the videos are in multiple parts so I just link to the whole blog:

Wednesday, April 28, 2010

Large RBAC putback

Today OpenSolaris had a large putback for RBAC, Role Based Access Control.

Previously you had where more restricted i your choice of shells able to utilize RBAC roles and profiles fully, only pfsh, pfksh and pfsh where available. A frequent change request for years have been to add support the GNU shell bash. This update add among other things a support for both pfbash and pfzsh thanks to a new in kernel implementation of the pfexec command.

This also add two new privileges FILE_READ, FILE_WRITE which can be used to implement different processes that can only write respectively read from files.

For those unfamiliar with RBAC it's the Role Based Access Control used in Solaris, it provides, unlike tools like sudo, the ability to delegate specific privileges to users or roles instead of just allowing certain commands to be executed as root. Privileges are fine grained and contains right to execute, fork, link, bind to a privileged port, use DTrace and many more.