Oracle Solaris 11.3 加密与证书管理指南

需积分: 2 11 浏览量更新于2024-06-24 收藏 714KB PDF 举报

"Oracle Solaris 11.3 管理加密和证书" 在Oracle Solaris 11.3操作系统中，管理和维护加密以及证书是确保网络安全和数据隐私的关键环节。Oracle Solaris 11.3 提供了强大的安全功能，包括先进的加密技术、证书管理工具，以及对公钥基础设施(PKI)的支持，来帮助管理员保护系统免受未经授权的访问和数据泄露。一、加密管理 Oracle Solaris 11.3 提供了内置的加密框架，支持多种加密算法，如AES（高级加密标准）、RSA（公钥加密标准）和SHA（安全哈希算法）。这些算法用于数据的加密和解密，以及数字签名的创建和验证，确保数据在传输过程中的安全性。管理员可以通过内建的加密工具如`gencert`、`keytool`和`pk12util`等进行密钥对生成、密钥库管理及证书请求。二、证书管理在Oracle Solaris 11.3中，证书是用于身份验证和建立安全连接的重要组件。系统支持X.509标准，可以创建、导入和管理SSL/TLS证书，用于HTTPS服务、电子邮件安全以及其他基于PKI的服务。`certtool`命令行工具允许管理员进行证书生命周期管理，包括颁发、撤销和更新证书。同时，系统还提供了集成的证书存储库，方便管理和查找证书。三、网络服务加密对于网络服务，如SSH（安全外壳协议）、SMTP（简单邮件传输协议）和FTP（文件传输协议），Oracle Solaris 11.3 支持启用加密通信，确保数据在传输过程中不被窃取。通过配置服务的SSL/TLS设置，管理员可以强制这些服务使用加密连接，提升服务器的安全级别。四、安全策略与访问控制 Oracle Solaris 11.3 提供了精细的访问控制机制，如ZFS文件系统的ACLs（访问控制列表）和SMF（System Management Facility）服务的安全策略。这些功能使管理员能够严格控制谁可以访问哪些资源，以及他们可以执行的操作，从而增强系统的安全性。五、密钥管理密钥管理是Oracle Solaris 11.3 中一个至关重要的方面。系统提供了安全的密钥存储和备份机制，以防止密钥丢失或被盗用。使用`keytool`和`kadmin`命令，管理员可以生成、备份和恢复密钥，确保服务连续性和数据完整性。六、安全更新与合规性 Oracle Solaris 11.3 提供自动更新和补丁管理功能，确保系统及时得到最新的安全修复，以应对不断演变的威胁。同时，系统提供审计和日志记录功能，帮助管理员满足各种安全法规和合规性要求。 Oracle Solaris 11.3 在加密和证书管理方面提供了全面而强大的功能，为企业和组织提供了坚实的基础，以保护其关键数据和网络资源。通过熟练掌握这些工具和策略，管理员可以构建一个高度安全的计算环境，抵御潜在的安全威胁。

Introduction to the Cryptographic Framework

of Oracle Solaris. svc:/system/cryptosvcs is the service instance for the Cryptographic

Framework. For more information, see the smf(5) and svcadm(1M) man pages.

User-Level Commands in the Cryptographic Framework

The Cryptographic Framework provides user-level commands to check the integrity of files, to

encrypt files, and to decrypt files.

■

digest command – Computes a message digest for one or more files or for stdin. A digest

is useful for verifying the integrity of a file. SHA1 and SHA384 are examples of digest

functions.

■

mac command – Computes a MAC for one or more files or for stdin. A MAC associates

data with an authenticated message. A MAC enables a receiver to verify that the message

came from the sender and that the message has not been tampered with. The sha1_mac and

sha384_hmac mechanisms can compute a MAC.

■

encrypt command – Encrypts files or stdin with a symmetric cipher. The encrypt -l

command lists the algorithms that are available. Mechanisms that are listed under a user-

level library are available to the encrypt command. The framework provides AES, 3DES

(Triple-DES), and Camellia mechanisms for user encryption.

■

decrypt command – Decrypts files or stdin that were encrypted with the encrypt

command. The decrypt command uses the identical key and mechanism that were used to

encrypt the original file.

■

elfsign command – Provides a means to sign providers to be used with the Cryptographic

Framework. Typically, this command is run by the developer of a provider. The elfsign

command has subcommands to request a certificate, sign binaries, and verify the signature

on a binary. Unsigned binaries cannot be used by the Cryptographic Framework. Providers

that have verifiable signed binaries can use the framework.

Plugins to the Cryptographic Framework

Third parties can plug their providers into the Cryptographic Framework. A third-party provider

can be one of the following objects:

■

PKCS #11 shared library

■

Loadable kernel software module, such as an encryption algorithm, MAC function, or digest

function

■

Kernel device driver for a hardware accelerator

The objects from a provider must be signed with a certificate from Oracle. The certificate

request is based on a private key that the third party selects, and a certificate that Oracle

Chapter 1 • Cryptography in Oracle Solaris 15

Introduction to the Cryptographic Framework

provides. The certificate request is sent to Oracle, which registers the third party and then issues

the certificate. The third party then signs its provider object with the certificate from Oracle.

The loadable kernel software modules and the kernel device drivers for hardware accelerators

must also register with the kernel. Registration is through the Cryptographic Framework SPI

(service provider interface).

Cryptographic Framework and Zones

The global zone and each non-global zone has its own system/cryptosvc service, which

manages the Cryptographic Framework. When the cryptographic service is enabled or refreshed

in the global zone, the kcfd daemon starts in the global zone, user-level policy for the global

zone is set, and kernel policy for the system is set. When the service is enabled or refreshed in

a non-global zone, the kcfd daemon starts in the zone, and user-level policy for the zone is set.

Kernel policy was set by the global zone.

For more information about zones, see Introduction to Oracle Solaris Zones. For more

information about using SMF to manage persistent applications, see Chapter 1, “Introduction to

the Service Management Facility” in Managing System Services in Oracle Solaris 11.3 and the

smf(5) man page.

Cryptographic Sources and FIPS 140-2

FIPS 140-2 is a U.S. Government computer security standard for cryptography modules.

Oracle Solaris systems offer two providers of cryptographic algorithms that are approved for

FIPS 140-2 Level 1.

■

The Cryptographic Framework of Oracle Solaris is a provider of two FIPS 140-2 approved

modules. The userland module supplies cryptography for applications that run in user space.

The kernel module provides cryptography for kernel-level processes.

■

The OpenSSL object module provides FIPS 140-2 approved cryptography for SunSSH

and web applications. For information about the implementations of Secure Shell in Oracle

Solaris, see “About Secure Shell” in Managing Secure Shell Access in Oracle Solaris 11.3.

Note the following key considerations:

■

Because FIPS 140-2 provider modules are CPU intensive, they are not enabled by default.

As the system administrator, you are responsible for enabling the providers in FIPS 140-2

mode and configuring applications that use the FIPS 140-2 approved algorithms.

16 Managing Encryption and Certificates in Oracle Solaris 11.3 • December 2018

剩余91页未读，继续阅读

weixin_40191861_zj

粉丝: 83
资源: 1万+

Oracle Solaris 11.3 加密与证书管理指南

Oracle Solaris 11.2 Managing Encryption and Certificates in aOra

Oracle Solaris 11.3 Managing Devices in Oracle Solaris 11.3-282

Oracle Solaris 11.3 Managing Auditing in Oracle Solaris 11.3-16

Oracle Solaris 11.3 Managing Kerberos and Other Authentication S

Oracle Solaris 11.3 Managing Network Virtualization and Network

Oracle Solaris 11.3 Managing User Accounts and User Environments

Oracle Solaris 11.3 Managing SAN Devices and Multipathing-190

Oracle Solaris 11.3 Managing SMB File Sharing and Windows Intero

Oracle Solaris 11.3 Managing Serial Networks Using UUCP and PPP

Oracle Solaris 11.3 Managing System Information, Processes, and

最新资源