Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Oracle Solaris 11: First Look

You're reading from   Oracle Solaris 11: First Look A sneak peek at all the important new features and functionality of Oracle Solaris 11

Arrow left icon
Product type Paperback
Published in Jan 2013
Publisher Packt
ISBN-13 9781849688307
Length 168 pages
Edition 1st Edition
Languages
Arrow right icon
Author (1):
Arrow left icon
Philip P. Brown Philip P. Brown
Author Profile Icon Philip P. Brown
Philip P. Brown
Arrow right icon
View More author details
Toc

Table of Contents (19) Chapters Close

Oracle Solaris 11: First Look
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
1. IPS – The Image Packaging System FREE CHAPTER 2. Solaris 11 Installation Methods 3. Sysadmin Configuration Differences 4. Networking Nuts and Bolts 5. NWAM – Networking Auto-reconfiguration 6. ZFS – Now You Can't Ignore It! 7. Zones in Solaris 11 8. Security Improvements 9. Miscellaneous IPS Package Reference
New ACL Permissions and Abbreviations
Solaris 10 Available Enhancements Index

Immutable zones


Full configuration details for immutable zones are covered in Chapter 7, Zones in Solaris 11, but it is worth mentioning the rationale for them here.

To have an almost hack-proof system, it is very effective to take away write access from it as much as possible. If you are willing to run your services in a zone, it is possible to configure that zone as an immutable zone. This allows you to render filesystems and even service configurations as immutable (that is, non-writable).

Most remote attacks succeed by eventually writing corrupted data to the filesystem, and then taking more control from there. If they cannot write to the filesystem, many avenues of attack are closed. Furthermore, if they cannot deface the site, or store their own files, the incentive for taking over the system may also have been removed.

There are varying levels of immutability possible. If your services will not run in a fully read-only zone, it is possible to allow access to /var, and a few other filesystems...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image