Skip Navigation Links
Exit Print View
| SPARC and Netra SPARC T4 Series Servers ### Security Guide

Search Scope:

- This Document
- Entire Library

### Planning a Secure Environment

Use the following notes before and during the installation and configuration of a server and related equipment.

##### Hardware Security

Physical hardware can be secured fairly simply: limit access to the hardware and record serial numbers.

- Restrict access

  - Install servers and related equipment in a locked, restricted access room.

  - If equipment is installed in a rack with a locking door, always lock the rack door until you have to service the components within the rack.

  - Hot-plug or hot-swap devices are removed easily and especially require restricted accessibility.

  - Store spare field-replaceable units (FRUs) or customer-replaceable units (CRUs) in a locked cabinet. Restrict access to the locked cabinet to authorized personnel.

- Record serial numbers

  - Security-mark all significant items of computer hardware such as FRUs. Use special ultraviolet pens or embossed labels.

  - Keep a record of the serial numbers of all your hardware.

  - Keep hardware activation keys and licenses in a secure location that is easily accessible to the system manager in system emergencies. The printed documents might be your only proof of ownership.

##### Software Security

Most hardware security is implemented through software measures.

- When a new system is installed, change all default passwords. Most types of equipment use default passwords, such as `changeme`, that are widely known and would allow unauthorized access to the equipment. Also, devices such as network switches can have multiple user accounts by default. Be sure to change all account passwords.

- Limit use of the `root` superuser account. Oracle Integrated Lights Out Manager (Oracle ILOM) accounts such as `ilom-operator` and `ilom-admin` should be used instead whenever possible.

- Use a dedicated network for service processors to separate them from the general network.

- Protect access to USB consoles. Devices such as system controllers, power distribution units (PDUs), and network switches can have USB connections, which can provide more powerful access than SSH connections.

- Refer to the documentation that came with your software to enable any security features available for the software.

- A server can boot securely with WAN Boot or iSCSI Boot.

  - For an Oracle Solaris 10 release, refer to the Oracle Solaris Installation Guide: Network-Based Installations book

  - For an Oracle Solaris 11 release, refer to the Installing Oracle Solaris 11 Systems book for WAN Boot information and the System Administration Guide: Basic Administration book for iSCSI boot information.

The Oracle Solaris Security Guidelines document provides information on:

- How to harden Oracle Solaris

- How to use Oracle Solaris security features when configuring your systems

- How to operate securely when you add applications and users to a system

- How to protect network-based applications

Oracle Solaris Security Guidelines documents can be found at:

- http://www.oracle.com/technetwork/indexes/documentation/index.html#sys_sw

##### Firmware Security

Ordinary user accounts cannot edit the OpenBoot PROM (OBP) or other Oracle firmware. The Oracle Solaris Operating System uses a controlled firmware update process to prevent unauthorized firmware modifications. Only the superuser can use the update process.

For information for setting OBP security variables, refer to the OpenBoot 4.x Command Reference Manual at:

- http://download.oracle.com/docs/cd/E19455-01/816-1177-10/cfg-var.html#pgfId-17069

##### Oracle ILOM Firmware

Oracle Integrated Lights Out Manager (Oracle ILOM) is system management firmware that is preinstalled on some SPARC and Netra SPARC servers. Oracle ILOM enables you to actively manage and monitor components installed in your system. The way you use Oracle ILOM affects the security of your system.To understand more about using this firmware when setting up passwords, managing users, and applying security-related features, including Secure Shell (SSH), Secure Socket Layer (SSL), and RADIUS authentication, refer to Oracle ILOM documentation:

- http://www.oracle.com/pls/topic/lookup?ctx=E19860-01

Copyright © 2011, Oracle and/or its affiliates. All rights reserved. Legal Notices |