没有合适的资源？快使用搜索试试~ 我知道了~

首页Oracle Solaris 9和Sun ONE Application Server的安全管理指南

Oracle Solaris 9和Sun ONE Application Server的安全管理指南

需积分: 5 0 下载量 31 浏览量更新于2023-11-24 收藏 1.1MB PDF 举报

标题：《Oracle Solaris 9和Sun ONE应用服务器管理员安全指南》文件概述该文件是《Oracle Solaris 9和Sun ONE应用服务器管理员安全指南》的第150页。它是由Sun Microsystems, Inc.于2003年3月发布的，并受版权保护。该文件包含了有关Oracle Solaris 9和Sun ONE应用服务器的安全管理方面的重要信息和技术细节。该文件主要涵盖了Oracle Solaris 9和Sun ONE应用服务器的安全管理指南。其中包括了系统管理员在安装、配置、管理和维护过程中应采取的安全措施和最佳实践。它提供了详细的操作步骤和说明，以帮助管理员保护系统免受潜在的安全威胁和攻击。在该文件中，特别强调了保护该软件的机密信息和商业机密。任何未经Sun Microsystems, Inc.事先明确书面许可的使用、披露或复制都是被禁止的。对于政府用户来说，他们需要遵守Sun Microsystems, Inc.的标准许可协议和FAR及其补充规定的适用条款。此外，该文件还可能包含第三方开发的材料。对于商标或注册商标方面，其中提到了Sun, Sun Microsystems, the Sun logo, Java和Sun ONE logo，并且它们是由Sun Microsystems, Inc.拥有的。总而言之，该文件是《Oracle Solaris 9和Sun ONE应用服务器管理员安全指南》的重要组成部分，提供了有关安全管理的关键信息和操作指南，以帮助管理员保护系统免受潜在的安全威胁和攻击。通过遵循该指南，管理员可以确保Oracle Solaris 9和Sun ONE应用服务器的安全性，并有效管理和维护系统的安全性。

Product Support

16 Sun ONE Application Server 7 • Administrator’s Guide to Security • March 2003

Chapter 1

Introducing Sun ONE Application

Server Security

This section discusses fundamental security concepts and provides an overview of

security features and functionality as applied in the Sun™ ONE Application Server

7 environment.

This section addresses the following topics:

• Application Server Security

• HTTP Server Security Features

• J2EE Application Security Features

• Good Practices

• Files Associated With Server Security

NOTE Not all the content in this guide is applicable or usable for J2EE

applications; some material only applies to the HTTP server. For

information and instructions on developing secure J2EE

applications, refer to the J2EE specifications and the Sun ONE

Application Server Developer’s Guide.

Application Server Security

18 Sun ONE Application Server 7 • Administrator’s Guide to Security • March 2003

Application Server Security

As the administrator responsible for server security, you are focussing on

protecting the Sun ONE Application Server and its data from unauthorized access,

damage (both intentional and unintentional), theft, and misrepresentation. This is

done by using a combination of good security practices and a set of security tools,

which include such mechanisms as digital certificates, encryption, authorization,

and auditing.

In the Sun ONE Application Server environment, your general areas of

responsibility include:

• Certificate Administration

• SSL/TLS Encryption

• Authentication

• Auditing

Certificate Administration

A certificate consists of digital data that specifies the name of an individual,

company, or other entity, and certifies that the public key included in the certificate

belongs to that entity. Both clients and servers can have certificates.

Information on how certificates work in the Sun ONE Application Server

environment is contained in “Administering Certificates” on page 43.

SSL/TLS Encryption

Encryption is the process of transforming information so it is unintelligible to

anyone but the intended recipient; decryption is the process of transforming

encrypted information so that it is intelligible again.

A cipher is a cryptographic algorithm (a mathematical function), used for

encryption or decryption. The Secure Sockets Layer (SSL) and Transport Layer

Security (TLS) protocols supported by the Sun ONE Application Server contain

numerous cipher suites. Some ciphers are stronger and more secure than others.

SSL 3.0 and TLS 1.0 encryption protocols are supported. Information on encryption

can be found in “Administering SSL/TLS Encryption” on page 61.

HTTP Server Security Features

Chapter 1 Introducing Sun ONE Application Server Security 19

Authentication

Authentication is the mechanism by which callers and service providers prove to

one another that they are acting on behalf of specific users or systems. When the

proof is bidirectional, it is referred to as mutual authentication. For example, the user

may enter a user name and password in a web browser, and if those credentials

match the permanent profile stored in the active database domain, the user is

authenticated. The user is associated with this authenticated security identity for the

remainder of the session.

Server authentication refers to the confident identification of a server by a client; that

is, identification of the organization assumed to be responsible for the server at a

particular network address.

In virtual server authentication, you can have a different certificate database for each

virtual server on your system. Each virtual server database can contain multiple

certificates. Virtual servers can also have different certificates within each instance.

Auditing

Auditing is the method by which significant events are recorded for subsequent

examination, such as errors or security breaches. All authentication events are

logged to the Sun ONE Application Server logs. A complete access log provides a

sequential trail of Sun ONE Application Server access events.

Information on logging is contained in the Sun ONE Application Server

Administrator’s Guide.

HTTP Server Security Features

The HTTP server security features include:

• HTTP Server User-Group Authentication

• HTTP Server Host-IP Authentication

NOTE The features described as HTTP server features are applicable only

to the HTTP server side of the Sun ONE Application Server and not

for J2EE applications. In some cases, equivalent functionality is

available to J2EE applications as well.

HTTP Server Security Features

20 Sun ONE Application Server 7 • Administrator’s Guide to Security • March 2003

• HTTP Server SSL Client Authentication

• HTTP Server Access Control

• Netscape API (NSAPI)

HTTP Server User-Group Authentication

User-Group authentication requires that users authenticate themselves before access

can be granted. This is done by entering a user name and password, using a client

certificate, or using the digest authentication plug-in. Types of User-Group

authorization supported by the Sun ONE Application Server include Basic, Default,

SSL, Digest, and Custom.

For information on HTTP server User-Group authentication, refer to “HTTP Server

User-Group Authentication” on page 83 and “Implementing Host-IP

Authentication” on page 91.

For information on user-group authentication for J2EE applications, refer to the

Sun ONE Application Server Developer’s Guide.

HTTP Server Host-IP Authentication

Host-IP authentication, also known as Host-IP access control, is a method of limiting

access to the Admin Server, or the files and directories on your web site, by making

them available only to clients who are using specific computers.

Information on HTTP server Host-IP authentication is contained in “Implementing

Host-IP Authentication” on page 91.

HTTP Server SSL Client Authentication

Client authentication refers to authenticating client certificates by cryptographically

verifying the certificate signature and the certificate chain leading to the CA on the

trust CA list. Clients can have multiple certificates, much like a person might have

several different pieces of identification.

Information on HTTP server client authentication is contained in “Setting Up

Client Authentication” on page 102.

剩余149页未读，继续阅读

weixin_40191861_zj

粉丝: 83
资源: 1万+

上传资源快速赚钱

我的内容管理展开

我的资源快来上传第一个资源

我的收益

登录查看自己的收益

我的积分登录查看自己的积分

我的C币登录后查看C币余额

我的收藏

我的下载

下载帮助

Oracle Solaris 9和Sun ONE Application Server的安全管理指南

Oracle Solaris 9 -Administrator’s Guide to Security Sun ONE Appl

Oracle Solaris 11.2 Developer's Guide to Oracle Solaris 11 Secu

eraser-code-r2982.zip

Red_Hat_Enterprise_Linux-7-Security_Guide.zip_guide_red hat_secu

REST-spring-security.rar_java rest_java security_rest_rest secu

NIST SP800-41.pdf

藏经阁-Protecting-Pentests-Recommendations-For-Performing-More-Secu

secu-msg

Atelier-Secu:蛮力-词典

spring-boot-swagger.7z

最新资源