1

It's my understanding that it is not possible for a non-global zone to determine its global zone, however running this on the global zone creates a file called /etc/global-zone-name in all running zones.

zoneadm list | awk '$1!="global" {printf("uname -n | zlogin %s \"cat > /etc/global-zone-name\"\n",$1)}' | sh

My question: Is there any security risk to this approach? In other words is there any risk to a server knowing its global zone?

2 Answers 2

2

Security issues aside - creating a file with the global zone name is one solution. However, if your non-global zones (NGZs) are managed by some sort of Clustering solution (read: if the NGZs are likely to jump global-zones when there's a catastrophic failure), then this is going to "break".

I find that having a script run at boot-up (basically a small SMF) that does the following is a big help;

1) Run "/sbin/zonename". If "global", then;

2) Use "/sbin/eeprom" to store the hostname in an OpenBoot PROM (aka "OBP") variable.

This way, all a NGZ has to do to figure out it's GZ is check the contents of the OBP variable.

P.S: if your cluster-nodes have the cluster-name in their hostname, this really helps track-down a zone. E.g: Cluster "wwwfarm1" has physical servers "wwwfarm1a" "wwwfarm1b" and "wwwfarm1c"

1
  • Thanks, that helps. I just wish the organisation I'm working for was open to using proper naming conventions, it would make life so much easier, but that's not going to happen. Feb 4, 2014 at 10:07
1

it depents how you configured your solaris zone, if your zones are configure exclusive ip mode, one attacker can redirect all traffic with a man in the middle attack, for more information about solaris exclusive ip mode vs exclusive mode, you can read this link http://docs.oracle.com/cd/E19455-01/817-1592/geprv/index.html

From oracle DOCS solaris 10 zones vs solaris 11

Solaris 10: Shared IP stack provides datalink protection against MAC and IP spoofing. Exclusive zones not protected. Solaris 11: Protection against MAC and IP spoofing whether using Shared IP stack or Exclusive IP stack.

So in solaris 10 there is the provability than one zone admin can do one attack

3
  • This is a worthwhile comment on the general issues relating to shared IP mode, and the article is worth reading. However I don't think allowing the non-global zone to know its global zone's name exacerbates any risks with shared IP mode. Dec 3, 2013 at 9:38
  • Hello Philip, i verified in our solaris system, the non global zones doesn't have a MAC so, man in the middle is imposible
    – c4f4t0r
    Dec 3, 2013 at 11:56
  • "one zone admin can do one attack" - If your business is shared-hosting or selling virtual servers, I can understand the concern. However for most businesses with private systems, a "rogue zone admin attacking servers" is an HR problem, and not a security one.
    – Signal15
    Jan 28, 2014 at 13:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .