Sun Microsystems Inc. will continue to offer the Trusted Solaris version of its operating system as a separate product, a company official said Tuesday, trying to clear up any confusion that Sun may have caused in the marketplace. Sun executives have said several times recently that security features from Trusted Solaris, a hardened version of Sun’s OS used by the military, governments and some enterprises, will be added to its standard Solaris distribution. But the two product lines will continue to exist separately, said Ravi Iyer, Sun’s group manager of systems security marketing.
Trusted Solaris has Secure Future, Sun says
About The Author
Eugenia Loli
Ex-programmer, ex-editor in chief at OSNews.com, now a visual artist/filmmaker.
Follow me on Twitter @EugeniaLoli
a Trusted Windows ? =)
Now, does that mean the default Solaris is not to be trusted ?
isn’t it? What remains distinctly different from Trusted Solaris and the up-coming features of Solaris 10?
The biggest differences are there is no “root” account in Trusted Solaris, root is a role account. You can set this up with Solaris but it is not a default. Trusted Solaris by default uses Mandatory Access Control and Labeled Security, features that are not part of Solaris. Despite Sun’s decision to add trusted features to both Solaris 9 and Express, these features will probably never make it into the mainstream product.
Also the code for Trusted Solaris goes through an extreme development cycle with lots of checking. And a single CPU license costs $2,495.00.
I checked on Sun’s website and prices seem to start at $995 for the Desktop version, steep stuff. Its based on Solaris 8, but the “no root” feature you mentioned will appear in Solaris 10, and many of the other features I read on Sun’s website also sound like they’ll be in Solaris 10. So, what truely would be different once Solaris 10 ships beyond a much slower development cycle?
No the no root feature will not appear in Solaris 10 (unless the Solaris Express program software changes significantly which I have been using since last August). Trusted Solaris has Role Based Access Control configured during installation and the root user is called install, the system is configured as the install user. RBAC will be part of Solaris 10, but you will have to configure it after installation. See this for more information:
http://wwws.sun.com/software/solaris/trustedsolaris/ts_tech_faq/faq…
Also do not forget about Labeled Security, this allows Trusted Solaris to work in TCSEC (dead) B2/A1 and Common Criteria EAL4+ environments. I do not think Sun will put these features into Solaris 10.
The price I quoted is for the CERTIFIED Trusted Solaris Desktop, which costs considerably more.
and I work on a military base, you’d think I’d realize that. Even if there was no major difference (technically) between Trusted Solaris and Solaris 10, one would have oodles of certifications and the other would not. That is the key difference. We only within the last year rolled out Windows 2000 in various places due to the certification and screening process (unless absolutely critical, patches are not to be applied until given the official nod), NT 4 is still widely used in lots of places, as is Novel Netware. Also VMS, Linux, Solaris – very diversified place. 🙂 Still, I could have sworn Solaris 10 will not have a root user ala Trusted Linux…hmmm….
Or at least de-emphasis to the point of severely reduced staff supporting Trusted Solaris.
Also keep in mind that the EAL4 certificate says
“EAL4 permits a developer to gain maximum assurance from positive security engineering based on good commercial development practices which, though rigorous, do not require substantial specialist knowledge, skills, and other resources. EAL4 is the highest level at which it is likely to be economically feasible to retrofit an existing product line.”
“EAL4 is applicable to those circumstances where developers or users require a moderate to high level of independently assured security in conventional commodity (OSs) and are prepared to incur additional security-specific engineering costs.”
Quotes are from the Common Criteria documents.
A product at EAL4+ will not have undergone systematic vulnerability testing by a three letter security agency.
Sun says Sun’s products have a future.
No the no root feature will not appear in Solaris 10 (unless the Solaris Express program software changes significantly which I have been using since last August).
Yes it will — it’s already there. (If you downloaded the bits in August, look at the
privileges(5) man page.) Trusted and Solaris may continue to coexist as separate products, but the plan is to fold the innovations in Trusted into main-line Solaris. (And indeed, this has already happened with least privilege.)
It is not configured “out of the box” like it is in Trusted Solaris. When I install Solaris Express (any release from August 2003 to January 2004) the user is root, not install as in Trusted Solaris. The permissions are default, as are the privileges. To use privileges you have to configure the system to do so, just as you have to configure the system to have root as a role.
http://docs.sun.com/db/doc/816-1054/6m7gg4gut?q=privileges&a=view
I guess we will have to see what changes when Sun makes Solaris Express 2/04 available.
I hear Trusted Solaris is very good. SE linux, Adamantix, Immunix, Hardened Gentoo are some free alternatives to it. However, I’d suspect Solaris is far more developed and useable at this point.
There’s also a Trusted HP-UX and at one time Trusted VMS, Trusted Multics, etc. VMS is already pretty damned good as is, I’d love to have a copy of the Trusted one.
“a Trusted Windows ? =)”
There was a version of NT (4.0?) that was trusted. I think it was done by some company aftermarket. In the (ancient) DOD ratings, NT 4.0 was C2, not too shabby. I think that was with minors mods, removal of floppy, etc.