Entire environment on one machine with zones

I've been pondering some of what zones can do, and it occurred to me that one could build an entire reasonably secure environment using one machine with multiple zones...
* Global zone with no network ports active, console only
* One zone for firewall, heavily ipf'd - mapped to external and internal network ports
* One zone for webserver - mapped to internal network port
* One zone for fileserver - mapped to internal network port
* Other zones as needed - probably all mapped to internal network ports
* All zones secured with ipf to allow very little access, particularly from firewall zone
It seems like this would allow a very flexible environment, and would give the security of having multiple boxes.
Thoughts/Comments?

I've been pondering some of what zones can do, and it
occurred to me that one could build an entire
reasonably secure environment using one machine with
multiple zones...
* Global zone with no network ports active,
ve, console only
* One zone for firewall, heavily ipf'd - mapped to
to external and internal network ports
* One zone for webserver - mapped to internal
nal network port
* One zone for fileserver - mapped to internal
nal network port
* Other zones as needed - probably all mapped to
to internal network ports
* All zones secured with ipf to allow very little
tle access, particularly from firewall zone
It seems like this would allow a very flexible
environment, and would give the security of having
multiple boxes.
Thoughts/Comments? You are definately on the right track. If I haven't said it before, I will say it now - All services that can be, should be run in a zone. That means web servers, DNS servers, LDAP, file servers, etc. Between zones and least privilege (you are using least privilege aren't you), you can create a very secure and contained service environment.
Imagine the surprise of a script kiddie when by pure luck they compromise your zone, but sadly they can't install their favorite rootkit because /dev/kmem, /usr, /devices, etc. are completely off limits no matter how much they scream about having UID 0. Remember, this is even more secure than having multiple boxes; this is like having multiple boxes where root ain't root. The best part is that zones are cheap. You can create them at will without performance impact, and can limit resource usage via a number of different means.
There is a new paradigm in town and it's name is Zones. Use zones and use them often. This is a no lose proposition.
Happy zoning.
Thanks,
Jarod

Similar Messages

  • Deferred patching broken for machines with zones

    For a while I've noticed that Ive had trouble patching a couple of machines.
    I've managed to determine the significant characteristic identifying them.
    All the machines with a non global zone have the problem.
    To confirm, I added a test zone to a machine that was fine. And it immediately it developed the problem.
    Anyway, the symptom is that no deferred patches will install.
    So patches delayed by a "smpatch update" till the reboot fail to install.
    The sunucLog displays the following error
    Sep 17 10:30:05 webdb1 123186-03 [notice] Status Install Begin 123186-03
    Sep 17 10:30:05 webdb1 123186-03 [ALERT] Validating patches...
    Sep 17 10:30:05 webdb1 123186-03 [ALERT] Loading patches installed on the system...
    Sep 17 10:30:05 webdb1 123186-03 [ALERT] Loading patches requested to install.
    Sep 17 10:30:05 webdb1 123186-03 [ALERT] Checking patches that you specified for installation.
    Sep 17 10:30:05 webdb1 123186-03 [ALERT] svcadm: Instance "svc:/system/filesystem/local:default" has been disabled by another entity.
    Sep 17 10:30:05 webdb1 123186-03 [ALERT] ERROR: Enabling filesystem/local service failed.
    Sep 17 10:30:05 webdb1 123186-03 [ALERT] Status Install End 123186-03 Install Update installation failed
    Anyone got any workarounds for this problem.
    Is it a known issue.
    Or should I log a support request.

    Any progress on this? Its been 2 months. And sun has managed to put out an entire new update to Solaris.
    And a 119254-59 has been released. But neither includes a fix for this issue as far as I can tell...
    Its now basically impossible to patch machines with zones up to the latest kernel 137137-09 since that has a dependency on 119254-58.
    And machines with zones can't be patched if a version higher than 119254-53 is installed....

  • Is patching Sol 10 machines with zones safe?

    Now that Sun update has been released, "smpatch update" explicitly checks for the presence of non global zones and refused to run.
    Now, its fairly trival to reproduce the "smpatch update" functionality from "smpatch download" which still works and a bit of scripting.
    Ive done this on a test machine with zones with no obvious ill effects.
    However since Sun went to the trouble of disabling "smpatch update", you have to presume there was a good reason.
    So is patching machines with zones safe. Or is there some known problem with doing this.

    The problem was that the underlying tool patchadd was not zones aware and then changes (I believe for bug: 6200143 ) changed the exit codes that smpatch relies on.
    Now in Solaris 10 patchadd/patchrm now returns only an exit code of 1 or 0 when using zones which is insufficient both for smpatch and for the Update Manager.
    So there are two options:
    If the system does not have any local zones configured then you can run "patchadd -t" in transitional mode which reverts back to the old pre Solaris 10 rich return codes that smpatch needs.
    If there are zones on the system, using smpatch download + patchadd will work, but you cannot get rich status from patchadd:
    Running "patchadd -t" on a system with local zones gives:
    # patchadd -t
    Transition patching (-t option) is not supported in a zones environment.
    HTH
    ethan

  • Is iWeb only geared to work with one machine with publishing?

    Hi all,
    I used iWeb on my Mac at work and published a website. Whenever I needed to edit that page I just open up iWeb and make my changes and re-publish. But when I open iWeb from my Mac at home, I can no longer access my site from the site organizer. Does that mean I need to send myself the iWeb file stored locally on my work machine, and then if I publish from my other mac at home, does that overwrite the site page I published from work?
    It seems like iWeb is really geared to work in a one machine operation. Is this true or am I missing something? Let me know if I need to clarify further...thanx..

    It looks like the iweb stores the site you created in
    /Users/<your name>/Library/Application Support/iWeb/Domain.sites
    This is the file I take between machines if I want a copy of my website on another mac. So when I load this in the path above, I can open the site and edit / upload and make changes. Dont forget to take it with you when your done.

  • Sharing iTunes on one machine with multiple users... problems...

    Hi, I've recently done a fresh installation of XP, and have downloaded iTunes 7.1
    It's set up as follows:
    1 machine, 3 users:
    Administrator(Admin account) ; Me (limited) ; My partner (limited).
    I have set up the itunes folder in the shared documents as suggested in the apple KB article about multiple users on one machine.
    As administrator, I imported a CD and it's artwork from the store.
    Pointed all three users to the folder in the shared documents - exactly as per the KB article.
    I went into my everyday account, and pointed itunes to the itunes folder in the shared documents.
    it didn't see the tracks. I had to use the add folder to library in the file menu in order to get itunes to see it.
    is this just something that has to be accepted, or is there a way of making the folder 'live' so that i don't need to keep updating my library manually? - almost like a refresh?..

    Unfortunaely iTunes doesn't monitor for new files, so if you import a CD in one account, it will have to be added to the libraries of the other accounts manually - if the users want it.
    I guess this is both good and bad as it means that each account can have its own music choices while at the same time sharing a common pool of music files.

  • How can I have one calendar on one machine with 2 users

    I just replaced my macbook with a mac mini.  I created a second account, for my wife, on the machine.  Being 2 retired people, we don't need separate calenders. In fact, we often need to see what the other is doing.  So, what i'd like to do is have one shared library for each of the following:
    Calender, Address Book, and of course IPhoto.
    I believe the way to do this is to have the library file for each application stored under the system top level library that is shared system wide.  But, I don't have a clue how to do this.  We do not use iCloud do to security concerns.

    To move Contacts, calendar data, etc. information from Android to iOS you can use third party Apps on both devices the Apps will move this information to the "Cloud" with one App and back to your other device with another App.
    See, for example, PhoneCopy at http://www.phonecopy.com/en/

  • Running HTML DB apps on one machine with the database on another

    I first want to apologize for this question being asked AGAIN.
    I have spent the better part of the day reading through a lot posts regarding this issue (and there are a lot). My boss sent me this requirement on a new project that Oracle Forms and Reports run on one server and connect back to the database on another server for security. HTML DB needs to do the same thing.
    The question:
    I have found out that the DAD file needs to be modified to allow this type of set up to work and the HTTP server needs to be running on that server. He is asking what in the DAD file needs to be changed to allow this to work. Would someone provide me with an example of what would need to be changed?
    Also, I'm confused on the implementation of this. Currently all the applications I've created are for "in-house" users. This project is the first (that I've done) that is going to be open to users outside the company. I'm confused on the link that will be supplied to the users. After I import my application into the production database, I run it to get the link and send that to our users. If the application is going to be run from a different server from the database, how is/will the link to run the application be built? I hope I'm describing this well.
    Thanks,
    Joe

    Joe,
    You wouldn't have the database server "open to the outside world". All you'd need to have open would be the port for HTTP traffic.
    There are two scenarios -
    1) Having them both (DB & Apache) on the same machine
    You would still only have the HTTP port open. The "fear" is that if the Apache server is compromised then they have access to the database machine.
    2) Having them on separate machines.
    In this case if the Apache server is compromised then, since by definition, you have a route from the Apache server to the DB server then they can still reach the DB machine from the Apache server machine.
    The thing to do here is to ensure your Apache server is patched and secure, regardless of whether it's running on the same machine as the DB or not.
    I'd be interested to see what others think.

  • Installing 2 ssl certificate on one machine with two virtual hosts

    Hi,
    If you have a managed server in a cluster that has two virtual hosts running
    on it how can you intsall the ssl certificates for both virtual hosts, in
    the admin console.
    any help would be great!

    OK....I figured it out.
    I was able to set the IPV4 properties on the ones needing filtering to use the IP or OpenDNS as the primary DNS and my server address as the secondary and that works.
    I removed OpenDNS forwarder from the server, flushed dns on all machines and so far it's working perfectly.  The machines that are not going to be filtered just go through the server for DNS.
    Hopefully, after a while it doesn't break down!

  • Multiple MiniSAP systems on one machine, with remote access

    Hi,
    I'd like to ask if it is possible to install multiple versions of MiniSAP (6.10, 6.20, 2004, 2004s) on the same machine? An important requirement would be to be able to access all these systems remotely.
    Maybe the best option would be to install these onto different virtual machines which can be run at the same time. In this case how should I set up the router for remote access? Also, how can I define the SAPGui entries on my laptop to access these systems?
    Many thanks,
    Tamá

    If you are using DHCP (in most cases yes), after setting up virtual machine you will get another IP adress for that virtual machine, so that you are able to connect to this machine and of course connect to SAP system running there. You don't need to do any settings on router.
    In SAPGui you will create as many entries as you have SAP systems.

  • How to copy/move Portal database from one machine to another?

    I am receiving a ORA-22973 error (size of object identifier exceeds maxmum size allowed) on the wwsec_enabler_config_info$ table when attempting to import my entire "portal30" schema from one database to another on different Windows NT Servers.
    Background: I had Portal 3.0.9.8 installed, configured, and running with the following setup:
    Machine 1: Windows NT 4.0 SP 6, Oracle 9iAS 1.0.2.2, Oracle Portal 3.0.9.8
    Machine 2: Windows NT 4.0 SP 6, Oracle 8i Database 8.1.7.0.0
    We no longer have use of Machine 2 and needed to move the database over to Machine 1.
    I performed the following steps:
    1. Installed Oracle 8i database 8.1.7.0.0 on Machine 1.
    2. Set up the tablespaces in the database on Machine 1 to match the same names and sizes of the tablespaces in the database on Machine 2.
    3. Used the Oracle "exp" command to export the entire database that resided on Machine 2.
    4. Copied the ".dmp" file to Machine 1.
    5. Used the Oracle "imp" command to import the entire database on Machine 1.
    6. The import completed successfully with warnings. But I had received the ORA-22973 error during the import process.
    7. After it completed I compared the list of tables and packages in the "portal30" schema between the two databases. The wwsec_enabler_config_info$ table is missing.
    8. I tried to export and import only the wwsec_enabler_config_info$ table between the two databases, but continue to receive the ORA-22973 error.
    Without the table being created, access to the portal cannot be achieved.
    Here are my questions:
    1. Is there anyway to create the wwsec_enabler_config_info$ table without receiving the noted error?
    2. Is there any other workable way to get the portal database from Machine 2 to Machine 1?
    I am aware of the portal import/export utilities but that would require me to run through the 2 hour install of Portal 3.0.9.8 on the database on Machine 1 and then individually export and import all the portal components (security, pages, applications, content library, etc). I merely wanted to transfer the entire database from one machine to another, so I felt the Oracle exp/imp utilities would be quicker and less work.

    Hi,
    I've been hitting problems with Portal 3.0.9.8.1 against 8.1.7.2.1 on NT - i.e., Intermedia not working at all, and have been advised by support to move back to 8.1.7.1.1.
    I don't want to lose any of my content in the Portal since the db upgrade and am wondering on what is the best way to do this.
    The version of the Portal will be the same so I am hoping I can just use the Portal export and import utilities, as afterall, it is just data and the schema structures are the same between db versions. I'm also hoping that the Portal export doesn't use the standard Oracle EXP tool as it doesn't work anymore on 8.1.7.2.1 on NT!!
    Regards,
    John

  • Cloning Solaris 10 with zones

    What is the best method to use when cloning a Solaris machine with zones, to ensure all software is included and can be easily installed
    on new hardware?
    Thank you!

    If you use UFS, then ufsdump/ufsrestore
    If you use ZFS, then zfs send/zfs receive
    But, if you are using hardware or software RAID, you can also try to move one disk to an another machine.
    You can see with these simple examples, that you have several methods and it depends how you configured your machine, Solaris and the zones. And finally, it depends too what is the source machine and what is the target machine, and how they are configured.

  • Have multiple iTunes libraries on one machine?

    Hi,
    I want to have multiple iTunes libraries on one machine (with two different hard drives, internal fore mp3s and external for AAC files). One library is composed of mp3s for an iPod, I want the other library to have AAC audio files for burning CDs. I would rather the libraries not be mixed.
    I have read the article (#301748) for migrating an iTunes library and am preparing to migrate one of the libraries on to a external hard drive.
    I have read about using Libra to maintain two different libraries on one machine. I was wondering if anyone does this and if they have encountered any problems? Is there a better solution?
    Thank you,
    TPK

    It's one thing to want two music libraries on one machine and another to want two music libraries on one user account. For the latter, here's what I've done.
    I created folders in my iTunes folder called, say, Main Library Folder and Second Library Folder. (These could be anywhere you find convenient.) I dragged my regular iTunes Library file into the Main Library Folder. Then I opened iTunes and created my second music library. When I finished that, I closed iTunes and dragged the just-created iTunes Library file into the Second Library Folder.
    If I want to use my main iTunes library, before opening iTunes I drag an alias (Cmmd-Option-drag) of the iTunes Library file from the Main Library Folder into the iTunes folder. Then, when I open iTunes, iTunes reads my main library file. And of course, it works the same way for the second library.
    Of course, you could just shuffle the actual library files into position in the iTunes folder from their holding areas, but I strongly preferred to get myself into the habit of relying on aliases, so I could leave the actual library file alone in their respective folders. You most definitely would not want to accidentally overwrite one of your iTunes Library files.
    I'm sure one of the shareware products would do a more elegant job, but this just shows you that it's not a difficult process.
    The alternative is to set up separate user accounts to access different libraries on the same machine. This has real benefits and, to me, should be the first option one considers. It's easier on the brain, as it sticks to iTunes' one-user-one-library model, and there's absolutely no risk of getting libraries confused. Fast User Switching on the Mac makes going back and forth between accounts easy. But if you really want to avoid using different accounts, and it's only you that has to keep things straight, the approach of jumping back and forth between different libraries in the same user account should be OK.

  • Several operation in one machine

    Dear All,
    my clile requirement is they have one machine they produce several things for example there is mixing machine where they mix chocolate, nuts, biscuits, etc many things in one machine with different capacity how can i map this scenario in sap.
    kindly help me in this regard i will be very obliged.
    thanks in advance
    irfan

    Dear,
    You need to assign the same work center (Machine) in routing of the material  chocolate, nuts, biscuits and define there operion time accordingly. So you can carry out the several operation in one machine .
    Hope clear to you.
    Regards,
    R.Brahmankar

  • Jabber 4.4 "Graphics card or driver not supported" error on one machine but not another.

    Hi, I looked at the KB document but the email link on it no longer works.
    I have two end-users using Jabber 4.4 on identical machines, same specs, same driver build and OS image. One gets the  "Graphics card or driver not supported" error, the other does not.
    We have two DellOptiPlex 7010's,
    Both had 2 instances of AMD Radeon HD 7470 - they are dual monitor machines.
    In both cases the driver version 8.922.0.0, Driver Date 12/6/2011. This is the latest Dell has on their website.
    On one machine when I run a fresh install for Jabber for TelePresence 4.4 it works fine. But on another the user first gets
    "supportabilitytest.exe has stopped working
    A oriblem cause the program to stop working correctly. Please close the program."
    Then when that's closed out we get:
    "Graphics card or driver not supported!
    New features in this version of Jabber Video are not supported by your computer's graphics driver.
    Update to the newest graphics driver available and run Jabber Video again."
    I can't believe it's just a matter of upgrading the drivers because in this case one machine with identical drivers works.
    I appreciate any insights, thanks !

    Hi ksouthall,
    It sounds like the openGL supported version did not install on the one that is failing.  There isn't much we can do regarding that error.  Best practice is to always upgrade to the latest manufacturer's available driver.  Client requirements are below.
    Windows 7 (32-bit or 64-bit), Vista, or XP (SP 2 or newer), with OpenGL 1.2 or newer.
    For 720p HD video calls, Intel Core2Duo @ 1.2GHz or better.
    For VGA video calls, Intel Atom @ 1.6GHz or better.
    Webcam, built-in or external. You need an HD webcam if you want other callers to see you in HD.
    Broadband Internet connection with a recommended bandwidth of 768kbps upstream and downstream. You need about 1.2Mbps upstream and downstream for 720p HD video calls.
    Regards,
    Jason

  • AS10gR2 + AS10R3 on one machine

    Hi,
    I have installed AS10gR2 infrastructure, AS10gR2 middleware and AS10gR3 on one machine with Windows 2000.
    So now I have 1 database instance, 3 opmns and 3 enterprise managers running, which consumes pretty much sources and it's quite slow.
    Since I have only 1 AS license (per processor) but I need Reports, Portal as well as J2EE 1.4 compatible AS (ADF Faces applications), I am looking for some way how to lighten this configuration.
    Any recommendation or links appreciated
    thanks,
    Branislav

    reposted.
    anybody?

Maybe you are looking for