Solaris 11 Security - a live demo in slides

167 Pages·2013·1.42 MB·English

by  Lynn Rohrer

Solaris 11 Security
- a live demo in slides -
by Joerg „c0t0d0s0.org“ Möllenkamp
1 c0t0d0s0//org
This slideset was made to have a fallback for a live demo
at a series of Oracle Breakfast events in Germany,
as the presentation diverted a lot in the first location
in the light of recent events around privacy and security.
However most information is in the voice track that wasn‘t recorded.
So this presentation may be not that useful.
If you need the voice track, ask your Oracle sales rep that he ask his manager
to ask my manager to let me doing the presentation in your country ;)
c0t0d0s0//org
Primarily i used example from my practical work and from my own blog
however i would like to thank two colleagues:
Glenn Faden for “Oracle Solaris Extended Policy and MySQL“
https://blogs.oracle.com/gfaden/entry/oracle_solaris_extended_policy_and
Darren Moffat for “Compliance reporting with SCAP“
https://blogs.oracle.com/darren/entry/compliance_reporting_with_scap“
I directly reused their blog entries for this presentation.
c0t0d0s0//org
Certifications
4 c0t0d0s0//org
Solaris 10 Common Criteria Evaluation
has been certified on EAL4+ level
c0t0d0s0//org
We have a common Criteria Certification.
For Solaris 10 at the moment. For Solaris 11 in the future.
However the common criteria certification doesn‘t certify security.
c0t0d0s0//org
Solaris 10 Trusted Extensions Common Criteria Evaluation
has been certified on EAL4+ level
http://www.oracle.com/technetwork/topics/security
/oracle-cc-evalsolaris-083233.html#sol10U3TX
The following protection profiles were used:
Conditional Access Protection Profile
Role Based Access Control Protection Profile
Label Security Protection Profiles
c0t0d0s0//org
Solaris 11.1 is currently in certification.
http://www.oracle.com/technetwork/topics/security/security-evaluations-099357.html#InEvaluated
c0t0d0s0//org
Is it really a Solaris 11
binary?
9 c0t0d0s0//org
:~$ elfsign verify -v /usr/bin/oscap
elfsign: verification of /usr/bin/oscap passed.
format: rsa_md5_sha1.
signer: CN=SunOS 5.10, OU=Solaris Signed Execution, O=Sun Microsystems Inc.
10 c0t0d0s0//org