HP-UX Secure Resource Partitions (SRP) A.02.02 Administrator's Guide

will succeed. However, the sshd daemon running in the SRP compartment might not receive SSH

connection requests on its socket.

To prevent sshd address collisions, the srp_sys utility prompts for the system sshd configuration

file name (the configuration file that the sshd daemon running in the INIT compartment would use)

and checks if this file configures the daemon to listen on a wildcard IP address. If so, srp_setup

asks if you want to set the ListenAddress variable to specific addresses instead of a wildcard IP

address.

1.3.2.3 Recommendations

Because of the INIT compartment properties, HP recommends that you:

• Do not use the INIT compartment to run non-system management applications or non-

essential services. Any application or service that is not intended to be shared by SRPs should

be run in an SRP and not in INIT.

• Manage system resources when logged in to the INIT compartment. If a utility manages

system-wide resources or configuration files, such as SMH, run the utility from the INIT

compartment. The SRP utilities manage system resources and should be executed from the

INIT compartment.

• Run swinstall and swremove from the INIT compartment. Do not install system software

or utilities from within an SRP compartment. By default, an SRP compartment will have file

access rules that prevent you from successfully installing system software.

• Execute associated applications from within the same SRP compartment. This enables the

processes to share common file system directories, IPC facilities, and network security rules.

1.3.3 Cross-Compartment Network Traffic

SRP compartments provide isolated networking environments. By default, an SRP compartment is

configured so that the only networking traffic allowed is through the compartment-specific IP interface,

through the phyiscal network layer, or through the network looback layer to other SRPs on the same

server. You can manually configure compartment access rules (network block rules) to prevent

loopback networking to a second SRP compartment.

NOTE: Configuring cross-compartment rules can interfere with the ability to import compartments to

another system. See 17 Exporting and Importing SRPs for more details.

1.3.4 IP Routers and Strong End System (ES) Model

To ensure proper routing, SRP configures the system to use the strong end system (ES) model, as

described in RFC 1122 to provide symmetric routing of connection based network traffic. When the

strong ES model is used, a system cannot act as an IP router. A system with the strong ES model

silently drops incoming IP packets with destination IP addresses that do not match the interface

address. Outbound IP packets must use the interface address as the source IP address.

1.3.4.1 Application Gateway Servers

Although SRP systems cannot be used as IP routers, they can be used as application gateway servers.

Application gateway servers receive IP packets sent to a local IP address, process the packets at an

upper layer, and retransmit the packets using the local IP address as the source address.

1.3.5 SRP Login Users

The SRP login service assigns a set of HP-UX users and groups the RBAC authority to log in to the

compartment. Only users in this set will be allowed to login to the SRP. HP recommends tha you

create a group for each SRP and apply this group to the SRP login service.