- Overview
- Enhancing Security
- Recommendations and Methodologies for Minimization
- Background
- Qualifying a Solaris Configuration
- Automating Domain Installations
- Using Scripts to Qualify a Solaris Configuration
- Minimization Methodology
- About the Authors
- Acknowledgements
- Related Resources
- Ordering Sun Documents
- Accessing Sun Documentation Online
Background
This section describes the Sun Fire systems covered by this article, defines the extent of minimization on these systems, and describes the system configurations used for testing.
This section contains the following topics:
"Assumptions and Limitations" on page 4
"Hardware Overview" on page 5
"Domains and System Controllers" on page 5
"Hardware Differences" on page 5
"Domain Differences" on page 6
"Domain Installations" on page 6
"Hardware Configurations" on page 7
Assumptions and Limitations
Sun Fire V1280, 6800, 12K, and 15K domains are Solaris systems that can be accessed either through a network or from a built-in system controller (SC). The methodology described in this article addresses new automated OE domain installations using JumpStart technology. Minimization of already deployed or installed domains is neither recommended nor supported.
This article is focused on developing minimized systems for deploying customer applications. The general methodology can be applied to determine the packages required for components in the Solaris Operating Environment (Solaris OE).
One of the most important details to gain from this article is the technique used to define a minimized system for a user application. This technique allows customers to apply a similar strategy to define a minimized system for their own applications. The example applications detailed in this article serve as a guide to this technique.
Hardware Overview
This article focuses on minimizing Sun Fire V1280, 6800, 12K, and 15K domains only. It does not cover minimizing SCs. The following subsections provide brief descriptions of the important differences of this hardware.
Additional information on these products is available in their product documentation manuals at http://docs.sun.com. Additionally, security best practice recommendations are available in the following Sun BluePrint OnLine articles available at http://sun.com/security/blueprints:
"Securing Sun Fire 12K and 15K System Controllers"
"Securing Sun Fire 12K and 15K Domains"
"Securing the Sun Fire Midframe System Controller"
Domains and System Controllers
A domain is a virtual, installable Solaris system within a Sun Fire 6800, 12K, and 15K chassis. More than one domain might be defined for a single chassis and each of the domains are independent and isolated from one another.
NOTE
The Sun Fire V1280 does not support domains. It has a single Solaris system that is described in "Domain Differences" on page 6 of this article.
The SC is a separate system built into the chassis that defines, controls, and monitors domains contained within the chassis. A domain is defined through the system controller by assigning appropriate hardware components to it.
Hardware Differences
The Sun Fire hardware is divided into two groups defined by differences in the SC.
The Sun Fire 12K and 15K systems use two independent UltraSPARC_ II systems built into the chassis to provide failover capability. These both run the Solaris OE and have custom-written software to remain synchronized.
The V1280 and 6800 chassis SCs are not Solaris based. They run the VxWorks operating system (OS) on the SC; the OS has the software for configuring domains implemented in firmware. Due to the limited nature of these SCs, it is often a requirement to have an additional Solaris based machine to act as a monitoring system for the domains.
NOTE
The Sun Fire V1280 and Netra 1280 server are functionally equivalent. Their main physical difference is that the Netra 1280 server is powered by DC power supplies and is certified to be NEBS-compliant security hardware. This article refers specifically to the Sun Fire V1280, but the software minimization aspects are equivalent on both.
Domain Differences
Once configured, the individual domain differences are minor. The following are the possible configurations:
The Sun Fire 15K can be configured into a maximum of 18 domains.
The Sun Fire 12K can accommodate a maximum of 9 domains.
The Sun Fire 6800 can be configured as a maximum of 4 domains in the 6800, and 2 domains in 3800 and 48x0.
The Sun Fire V1280 server consists of a single, default Solaris system that can be configured as 4, 8, or 12 UltraSPARC III CPUs. Although the Sun Fire V1280 does not support domains, the Solaris instance is viewed as a single domain instance for the purposes of this article.
NOTE
The Sun Fire V1280 server has dedicated serial and Ethernet ports for remote monitoring and administration capabilities by the Lights Out Management (LOM) module, independent of the Solaris OE, running on the SC.
Domain Installations
Automating a domain installation requires a Solaris system to be configured to act as a JumpStart server. The Sun Fire 12K and 15K SC can be used for this function. However, configuring a JumpStart server is beyond the scope of this article.
Because the Sun Fire V1280 and 6800 SCs are not Solaris based, they require an external Solaris based system to act as the JumpStart server. For more information on JumpStart technology and how it can be used to configure servers, refer to the Advanced Installation guide available at http://docs.sun.com or the Sun BluePrints book titled JumpStart TechnologyEffective Use in the Solaris Operating Environment.
Hardware Configurations
In this article, the configurations used for testing are a Sun Fire 15K, a Sun Fire 6800 (midframe), and a Sun Fire V1280. Testing makes use only of two domains on these systems. The other domains are separate and independent.
The Sun Fire 15K is running Solaris 9 (12/02) OE and SMS 1.3 on the SC. The Sun Fire 15K has a Capacity On Demand 2.0 software CPU board available with a pre-installed right-to-use (RTU) license. The CPU board is configured into the test domain when needed.
The Sun Fire 6800 is running firmware 5.14.0 on the SC. The Sun Fire 6800 has a Capacity On Demand 2.0 CPU board, consisting of four CPUs. The CPU board is configured into the test domain when needed.
The Sun Fire V1280 server contains a single CPU board consisting of four CPUs.