Programming Tutorials Browser Tutorials Articles Struts Tutorials Hibernate Tutorials

  Tutorial: Locking Down Server Access to SSH With SunScreen Software (Community Submission)

This Tech Tip shows how to lock down a server to a group of client machines, allowing SSH access only, using SunScreen software.

Tutorial Details:

Locking Down Server Access to SSH With SunScreen Software
Laurence Moughan, February 2005

The goal here is to lock down a server to a group of client machines, allowing SSH access only (for this example). This can be done by means of TCP wrappers, but we are using Sun\'s firewall product known as SunScreen software.

Deploy SunScreen packages from the Solaris 8 OS CD-ROM 2 of 2. Packages are found under Products/EA.

First you need to start SunScreen admin tool in edit mode and specify the name of a ruleset to create.

Hostname# cd /opt/SUNWicg/SunScreen/bin
hostname# ./ssadm edit local

This will create a ruleset named local to edit.

Loaded common objects from Registry version 10
Loaded policy from local version 1

Then you need to add objects for the local machine called self and the client machines that require access, where xxx.xxx.xxx.xxx is the IP of the machines.

Edit>Add ADDRESS \"self\" xxx.xxx.xxx.xxx
Edit>Add ADDRESS \"client1\" xxx.xxx.xxx.xxx
Edit>Add ADDRESS \"client2\" xxx.xxx.xxx.xxx

Now create an address group -- this is simplest way of applying a set of clients to a single rule.

add ADDRESS sshgroup {client1 client2 etc }

Now create a rule (SSH as a service already exists and does not need creation).

#add RULE \"ssh\" \"sshgroup\" \"self\" ALLOW

Now verify the configuration:

Edit>Verify
Edit>Configuration verified successfully (not activated).

And save the configuration.

Edit>save
Saved common objects to Registry version 1
Saved policy to local version 1

Quit out of edit, and then activate the ruleset.

Edit>quit

Hostname#./ssadm activate local

Now only your group of clients will be able to access the machine using SSH; no other access will be allowed


 

Read Tutorial at: Click here to view the tutorial

Rate Tutorial:
Locking Down Server Access to SSH With SunScreen Software (Community Submission)

View Tutorial:
Locking Down Server Access to SSH With SunScreen Software (Community Submission)

Related Tutorials:

Automatic Software Distribution of Java Applications
Automatic Software Distribution of Java Applications
 
A beginner's guide to Enterprise JavaBeans - JavaWorld - October 1998
A beginner's guide to Enterprise JavaBeans - JavaWorld - October 1998
 
Warning! Threading in a multiprocessor world - JavaWorld February 2001
Warning! Threading in a multiprocessor world - JavaWorld February 2001
 
Clean up your wire protocol with SOAP, Part 2 - JavaWorld April 2001
Clean up your wire protocol with SOAP, Part 2 - JavaWorld April 2001
 
Optimistic Locking pattern for EJBs - JavaWorld July 2001
Optimistic Locking pattern for EJBs - JavaWorld July 2001
 
Can ThreadLocal solve the double-checked locking problem?
Can ThreadLocal solve the double-checked locking problem?
 
Jini's relevance emerges, Part 2
Jini's relevance emerges, Part 2
 
J2SE 1.4 breathes new life into the CORBA community, Part 2
J2SE 1.4 breathes new life into the CORBA community, Part 2
 
Java tools reign supreme - JavaWorld celebrates the leading Java tools
Java tools reign supreme - JavaWorld celebrates the leading Java tools
 
Very interesting
Very interesting
 
Apache Geronimo
Apache Geronimo Welcome to Apache Geronimo, the J2EE server project of the Apache Software Foundation. Please help us make this a world class, certified J2EE container!
 
A Rendezvous with Java
A Rendezvous with Java During WWDC this year, Apple released Java source for Rendezvous. You can now write Java applications that can call on a Rendezvous service discovery on Mac OS X, Windows, and any POSIX system using code supplied by Apple. Apple in
 
Aspect-Oriented Programming in Java
This article is divided into three parts: The first part explaines the concepts of AOP, the second introduces AspectJ(TM), an implementation of the AOP concepts in Java, and part three compares the AOP approach to metalevel programming.
 
Bridging the Gap: J2SE 5.0 Annotations
Bridging the Gap: J2SE 5.0 Annotations It takes a long time for the Java community to fully absorb a major new JDK release; it seems to take about two more releases after a brand new version of the JDK before everything settles down. Application server v
 
Commons Transaction
Commons Transaction aims at providing lightweight, standardized, well tested and efficient implementations of utility classes commonly used in transactional Java programming. Initially there are implementations for multi level locks,
 
Unclog the server bottleneck with active containers.
In server-side control architectures such as Java ServerFaces (JSF) or Struts, a majority of the control events must be handled on the server side to update the state of the control. For every user event, the entire page data is sent back to the server...
 
Community Submission: A Recovery CD for the Solaris OS and VERITAS NetBackup Software
Build a recovery CD to restore root file systems using VERITAS NetBackup software, without having to install the OS on an alternate boot disk or configure and use a Solaris JumpStart server. (Submitted by a BigAdmin reader.)
 
SSH Port Forwarding Through a Proxy Server (Community-Submitted Tech Tip)
Learn how to use SSH port forwarding (tunneling) through a proxy server for secure connections.
 
What is Persistence Framework?
What is Persistence Framework? What is Persistence Framework? A persistence framework moves the program data in its most natural form (in memory objects) to and from a permanent data store the database. The persistence framework manages the
 
Locking Down Server Access to SSH With SunScreen Software (Community Submission)
This Tech Tip shows how to lock down a server to a group of client machines, allowing SSH access only, using SunScreen software.
 
Site navigation
 

 

Send your comments, Suggestions or Queries regarding this site at roseindia_net@yahoo.com.

Copyright © 2006. All rights reserved.