


Maintenance Commands                               ssadm-edit(1M)



NAME
     ssadm-edit - the SunScreen configuration editor

AVAILABILITY
     SUNWicgSS

SYNOPSIS
     ssadm edit policy
     ssadm edit policy < file
     ssadm edit policy -c commandstring

DESCRIPTION
     ssadm edit is the SunScreen configuration  editor,  or  "the
     editor" for short.  The editor interprets a command language
     providing a variety of commands for manipulating the objects
     that  make  up a SunScreen configuration.  These objects are
     stored in the Common Object Registry or in one or more named
     policies.   Each kind of object used in the SunScreen system
     is described in a man  page  in  Section  4.   For  example,
     address  objects  are  explained  in address(4).  The editor
     commands used for creating and manipulating the objects  are
     described  in  this man page, but the purposes and relation-
     ships of the objects are described in Section  4.   All  the
     available types of objects are summarized in intro(4).

OPTIONS
     The name of an existing policy is  required,  even  if  only
     common objects will be accessed.

     The configuration editor can be used in interactive mode  or
     batch mode.  In interactive mode, the editor prints a prompt
     (edit>) before each command is read from the  user's  termi-
     nal.   In  batch  mode,  the  editor  reads commands without
     prompting.  Commands are  read  until  the  editor  receives
     end-of-file or a quit command.

     Specifying the -c commandstring option causes the editor  to
     execute  the  commandstring in batch mode instead of reading
     commands from standard input.  commandstring must be a  sin-
     gle argument to the program, so in the UNIX shell it usually
     has to be quoted with single  or  double  quotes.   command-
     string may contain multiple commands separated by newlines.

     If ssadm edit is run without the -c option on an interactive
     terminal  and  its  input  and output are not redirected, it
     enters interactive mode automatically.  If standard input is
     a pipe or a file, the editor runs in batch mode.

COMMANDS
     The commands  supported  by  the  configuration  editor  are
     described  below.   In the descriptions, when the name of an
     object of a particular TYPE is required, it is indicated  by



                   Last change: 15 March 2000                   1






Maintenance Commands                               ssadm-edit(1M)



     name_TYPE.   Where  an  index  is needed, it is indicated by
     index.  A keyword that was required  in  previous  SunScreen
     releases but is now optional is indicated by <KEYWORD>.


     list list displays all entries or  a  specific  entry  of  a
          given  TYPE.   The  format of the output is the same as
          the syntax of the corresponding add  request  for  that
          TYPE.

          list TYPE [[SCREEN "name_SCREEN"] "name_TYPE"]
          list TYPE [index]

          TYPE must be a named object type, such as address or an
          ordered object type, such as rule.

          If TYPE is a named object type, a specific name can  be
          requested,  or all objects of that type will be listed.
          If a name but no SCREEN  option  is  present,  only  an
          entry  not  associated  with  a specific SCREEN will be
          listed.  If the SCREEN option value is  "*",  then  all
          entries with the specified name will be displayed.

          If TYPE is an ordered object type, a specific index can
          be  requested,  or  all  objects  of  that type will be
          listed.


     list_name
          list_name displays the  set  of  unique  basenames  and
          sub-type  of all of a given TYPE.  These are the values
          that can be used  when  another  object  refers  to  an
          object of the specified TYPE.

          list_name TYPE

          TYPE must be one of: address, screen, service, stateen-
          gine, interface, certificate, time, or vpn.


     search
          search searches the Registry  for  objects  that  match
          specified criteria.

          search TYPE [SCREEN  "name_SCREEN"]  [SUBTYPE  subtype]
          <EXACT> Substring

          TYPE must be one of: address,  certificate,  interface,
          screen,  service,  stateengine, or time.  Legal subtype
          values depend upon the TYPE being searched according to
          the following table:




                   Last change: 15 March 2000                   2






Maintenance Commands                               ssadm-edit(1M)



          address             HOST, RANGE, GROUP
          certificate         SINGLE, GROUP
          interface           ADMIN, DISABLED, ROUTING, HA, STEALTH
          screen
          service             SINGLE, GROUP
          stateengine
          time

          The EXACT keyword requires a substring be specified and
          will only match entries whose name is an exact match.


     add  add creates or redefines an entry.

          add TYPE parameters...

          If a named object type is specified and an  entry  with
          that  name  already exists, it is replaced with the new
          entry.  If it does not exist, one is created  with  the
          new  name.  All of the following have a similar request
          of add_nocheck,  which  does  not  perform  consistency
          checking.


     add address
          add address "name_ADDRESS" <HOST> #.#.#.#
          add address "name_ADDRESS" <RANGE> #.#.#.# #.#.#.#
          add address "name_ADDRESS" <GROUP> { "name_ADDRESS" ... } { "name_ADDRESS" ... }

          The following fields are optional and may be  specified
          in any order AFTER the "address" keyword:
          SCREEN "name_SCREEN"
          COMMENT "comment string"

          The addresses "*" and "localhost" are reserved and can-
          not be edited.


     add screen
          add screen "name_SCREEN"

          The following fields are optional and may be  specified
          in any order AFTER the "screen" keyword:

          MASTER "name_SCREEN"
          HA_PRIMARY     {Mutually excludes HA_SECONDARY}
          HA_SECONDARY   {Mutually excludes HA_PRIMARY}
          TIMEOUT #
          SNMP #.#.#.# ...    {Maximum of 5 entries; list can  be
          empty; not output if empty list}
          SNMP_TIMER #        {Timed Status  Indicator;  interval
          in  minutes to send Screen status information; requires



                   Last change: 15 March 2000                   3






Maintenance Commands                               ssadm-edit(1M)



          that SNMP is not empty}
          CDP                 {"on" if present, "off" otherwise}
          ROUTING             {"on" if present, "off" otherwise}
          DNS                 {"on" if present, "off" otherwise}
          NIS                 {"on" if present, "off" otherwise}
          LOGSIZE #           {default is 100MB if not present}
          STEALTH_NET #.#.#.# #.#.#.#    {Network and Netmask for
          STEALTH type Interfaces; required if any STEALTH Inter-
          faces are set}
          HA_IP #.#.#.#       {required if HA_PRIMARY is set}
          HA_ETHER xx:xx:xx:xx:xx:xx{required  if  HA_PRIMARY  is
          set}
          COMMENT "comment string"

          If the Screen is to be a  part  of  a  cluster,  admin-
          istered  remotely,  then  the  following fields must be
          specified as well.  They may be specified in any  order
          after the "screen" keyword:

          ADMIN_IP #.#.#.#
          ADMIN_CERTIFICATE "name_CERTIFICATE"
          KEY "name_KEY_ALGORITHM"
          DATA "name_DATA_ALGORITHM"
          MAC "name_MAC_ALGORITHM"
          COMPRESSION "name_COMPRESSION_ALGORITHM"
          TUNNEL "name_ADDRESS"

          The screen "*" is reserved and cannot be edited.


     add service

          add service "name_SERVICE" <SINGLE> filter ...
          add service "name_SERVICE" GROUP "name_SERVICE" ...


          For SINGLE services, a list of Filters follows the SIN-
          GLE  keyword.   The  list  must  not be empty, and each
          Discriminator list must also not be empty. A Filter  is
          of the form:
          FORWARD "name_STATEENGINE" discriminator ...
          REVERSE "name_STATEENGINE" discriminator ...

          An individual discriminator is as follows:
          PORT #
          PORT  #-#   (Note, no space is allowed before or  after
          the "-" character)
          BROADCAST #
          BROADCAST #-#

          An optional parameter for discriminators, which appears
          immediately AFTER the number or range it modifies, is:



                   Last change: 15 March 2000                   4






Maintenance Commands                               ssadm-edit(1M)



          PARAMETERS space-separated list of #

          For  GROUP  services,   a   space-separated   list   of
          "name_SERVICE" entries follows the GROUP keyword.

          The following fields are optional and may be  specified
          in any order AFTER the "service" keyword:
          SCREEN "name_SCREEN"
          COMMENT "comment string"

          The service "*" is reserved and cannot be edited.


     add interface

          add interface "name_INTERFACE" type "name_ADDRESS"


          type must be one of: ADMIN, DISABLED, ROUTING,  HA,  or
          STEALTH.

          The following fields are optional for STEALTH interface
          types  and  may  be  specified  in  any order AFTER the
          "interface" keyword.  Up to five  ROUTERs  per  STEALTH
          interface may be specified.  More may be specified, but
          only five (no guarantee which ones) will be used by the
          system.

          ROUTER #.#.#.# ...

          The following fields are  optional  for  ALL  interface
          types  and  may  be  specified  in  any order AFTER the
          "interface" keyword:

          SCREEN "name_SCREEN"
          COMMENT "comment string"

          The following fields are  optional  for  ALL  interface
          types EXCEPT DISABLED and may be specified in any order
          AFTER the "interface" keyword.

          LOG NONE            {also LOG_NONE, default if  no  LOG
          is specified}
          LOG SUMMARY         {also LOG_SUMMARY}
          LOG DETAIL          {also LOG_DETAIL}
          ICMP NONE           {also ICMP_NONE, default if no ICMP
          is specified}
          ICMP NET_UNREACHABLE{also ICMP_NET_UNREACHABLE}
          ICMP HOST_UNREACHABLE{also ICMP_HOST_UNREACHABLE}
          ICMP PORT_UNREACHABLE{also ICMP_PORT_UNREACHABLE}
          ICMP NET_FORBIDDEN  {also ICMP_NET_FORBIDDEN}
          ICMP HOST_FORBIDDEN {also ICMP_HOST_FORBIDDEN}



                   Last change: 15 March 2000                   5






Maintenance Commands                               ssadm-edit(1M)



          SNMP                {"on" if present, "off" otherwise}


     add certificate

          add certificate "name_CERTIFICATE" SINGLE NSID  #  MKID
          "#"
          add      certificate      "name_CERTIFICATE"      GROUP
          "name_CERTIFICATE" ...


          For  GROUP  certificates,  a  space-separated  list  of
          "name_CERTIFICATE" entries follows the GROUP keyword.

          The following fields are optional  for  SINGLE  entries
          and  may  be specified in any order AFTER the "certifi-
          cate" keyword:

          G #
          P #
          KEY_LENGTH #
          LOCAL "name_SCREEN"

          The following fields are optional and may be  specified
          in any order AFTER the "certificate" keyword:

          SCREEN "name_SCREEN"
          COMMENT "comment string"


     add time

          add Time "name_TIME"


          The following fields are optional and may be  specified
          in any order AFTER the "time" keyword:

          EVERYDAY
          SUNDAY
          MONDAY
          TUESDAY
          WEDNESDAY
          THURSDAY
          FRIDAY
          SATURDAY
          SCREEN "name_SCREEN"
          COMMENT "comment string"

          Following any of the "*DAY" keywords may be a  time  of
          day   specification   in  the  form  {timespec  ...}  .
          timespec is a time range in the form:



                   Last change: 15 March 2000                   6






Maintenance Commands                               ssadm-edit(1M)



          Start Hour:Start Minute Stop Hour:Stop Minute

          Examples are: "{ 1:00 2:30 }" and  "{  1:00  2:30  4:00
          6:00  }".   24-hour time format is used, therefore, the
          valid times are 0:00  (starting  at  midnight)  through
          24:00 (ending at midnight).


     add rule

          add rule "name_SERVICE" "name_ADDRESS" "name_ADDRESS"


          This appends the rule to the end of the list  of  rules
          in  the  Policy.  "insert rule" should be used to posi-
          tion a new rule into an existing Policy.

          The following fields are optional and may  be  specific
          in any order after the "rule" keyword:

          ALLOW               {default if no ACTION specified}
          DENY
          LOG NONE            {also LOG_NONE, default if  no  LOG
          is specified}
          LOG SUMMARY         {also LOG_SUMMARY}
          LOG DETAIL          {also LOG_DETAIL}
          LOG SESSION         {also LOG_SESSION, only  valid  for
          ALLOW rules, will be error for DENY}
          SNMP                {"on" if present; "off" otherwise}
          USER  "name_USER"    {only   used   if   PROXY_FTP   or
          PROXY_Telnet set below }
          TIME "name_TIME"
          SCREEN "name_SCREEN"
          COMMENT "comment string"

          The following combo-field is optional and only valid in
          a  rule  that has ALLOW specified.  It may be specified
          anywhere after the "rule" keyword:

          SKIP_VERSION_1  "name_CERTIFICATE"   "name_CERTIFICATE"
          "name_KEY_ALGORITHM" "name_DATA_ALGORITHM"
          SKIP_VERSION_2  "name_CERTIFICATE"   "name_CERTIFICATE"
          "name_KEY_ALGORITHM"              "name_DATA_ALGORITHM"
          "name_MAC_ALGORITHM" "name_COMPRESSION_ALGORITHM"

          The following fields are optional and only valid within
          a  SKIP_VERSION_1  or SKIP_VERSION_2 combo-field.  They
          may be specified in any order after the  SKIP_VERSION_#
          keyword:
          SOURCE_TUNNEL "name_ADDRESS"
          DESTINATION_TUNNEL "name_ADDRESS"




                   Last change: 15 March 2000                   7






Maintenance Commands                               ssadm-edit(1M)



          The following field is optional and  only  valid  in  a
          rule that has DENY specified.  It may be specified any-
          where after the "rule" keyword:
          ICMP NONE           {also ICMP_NONE, default if nothing
          is specified}
          ICMP NET_UNREACHABLE {also ICMP_NET_UNREACHABLE}
          ICMP HOST_UNREACHABLE{also ICMP_HOST_UNREACHABLE}
          ICMP PORT_UNREACHABLE{also ICMP_PORT_UNREACHABLE}
          ICMP NET_FORBIDDEN  {also ICMP_NET_FORBIDDEN}
          ICMP HOST_FORBIDDEN {also ICMP_HOST_FORBIDDEN}

          The following field is optional and  only  valid  in  a
          rule  that has ALLOW specified and NO SKIP information.
          It may be specified anywhere after the "rule" keyword:

          VPN "name_VPN"

          The following fields are optional and only valid  in  a
          rule  that has not specified any VPN or SKIP.  They may
          be specified anywhere after the "rule"  keyword.   Only
          one of them may be specified in a given rule.

          PROXY_FTP
          PROXY_HTTP
          PROXY_SMTP
          PROXY_Telnet

          The following fields are optional and only valid  in  a
          rule  that has specified PROXY_FTP.  They may be speci-
          fied anywhere after the "PROXY_FTP" keyword:

          FTP_GET
          NO_FTP_GET          {default if FTP_GET not specified}
          FTP_PUT
          NO_FTP_PUT          (default if FTP_PUT not specified}
          FTP_CHDIR
          NO_FTP_CHDIR        {default if  FTP_CHDIR  not  speci-
          fied}
          FTP_MKDIR
          NO_FTP_MKDIR        {default if  FTP_MKDIR  not  speci-
          fied}
          FTP_RENAME
          NO_FTP_RENAME       {default if FTP_RENAME  not  speci-
          fied}
          FTP_REMOVE_DIR
          NO_FTP_REMOVE_DIR   {default  if   FTP_REMOVE_DIR   not
          specified}
          FTP_DELETE
          NO_FTP_DELETE       {default if FTP_DELETE  not  speci-
          fied}

          The following fields are optional and only valid  in  a



                   Last change: 15 March 2000                   8






Maintenance Commands                               ssadm-edit(1M)



          rule that has specified PROXY_HTTP.  They may be speci-
          fied anywhere after the "PROXY_HTTP" keyword:

          COOKIES
          NO_COOKIES          {default if COOKIES not specified}
          ACTIVE_X
          NO_ACTIVE_X         {default if ACTIVE_X not specified}
          SSL
          NO_SSL              {default if SSL not specified}
          JAVA_SIGNATURE
          JAVA_HASH
          JAVA_SIGNATURE_HASH
          JAVA
          NO_JAVA             {default if no other  JAVA  setting
          is specified}

          The following fields are optional and only valid  in  a
          rule that has specified PROXY_SMTP.  They may be speci-
          fied anywhere after the "PROXY_SMTP" keyword:

          RELAY
          NO_RELAY            {default if RELAY not specified}


     add nat

          add   nat    STATIC    "name_ADDRESS"    "name_ADDRESS"
          "name_ADDRESS" "name_ADDRESS"
          add   nat   DYNAMIC    "name_ADDRESS"    "name_ADDRESS"
          "name_ADDRESS" "name_ADDRESS"


          The following fields are optional and may  be  specific
          in any order after the "nat" keyword:
          SCREEN "name_SCREEN"
          COMMENT "comment string"


     add accesslocal

          add accesslocal USER "name_USER"



     add accessremote

          add  accessremote   USER   "name_USER"   "name_ADDRESS"
          SKIP_VERSION_1  "name_CERTIFICATE" "name_KEY_ALGORITHM"
          "name_DATA_ALGORITHM"
          add  accessremote   USER   "name_USER"   "name_ADDRESS"
          SKIP_VERSION_2  "name_CERTIFICATE" "name_KEY_ALGORITHM"
          "name_DATA_ALGORITHM"              "name_MAC_ALGORITHM"



                   Last change: 15 March 2000                   9






Maintenance Commands                               ssadm-edit(1M)



          "name_COMPRESSION_ALGORITHM"


          The  following  field  is  optional  for   accessremote
          entries.   It  may  be specified in any order after the
          "accessremote" keyword:

          TUNNEL "name_ADDRESS"{ if the remote machine  is  using
          tunneling }

          The following fields are optional and may  be  specific
          in  any order after the "accesslocal/accessremote" key-
          word:
          PERMISSION ALL
          PERMISSION WRITE
          PERMISSION READ
          PERMISSION STATUS
          PERMISSION NONE       { default  if  no  PERMISSION  is
          specified }
          SCREEN "name_SCREEN"
          COMMENT "comment string"


     add vpngateway

          add   vpngateway   "name_VPN"    "name_ADDRESS"    SKIP
          "name_CERTIFICATE"


          The following fields are required and may  be  specific
          in any order after the "vpngateway" keyword:

          KEY "name_KEY_ALGORITHM"
          DATA "name_DATA_ALGORITHM"
          MAC "name_MAC_ALGORITHM"
          COMPRESSION "name_COMPRESSION_ALGORITHM"

          The following fields are optional and may  be  specific
          in any order after the "vpngateway" keyword:

          TUNNEL "name_ADDRESS"
          COMMENT "comment string"


     add_member
          add_member adds a member to a group or list.

          add_member address "name_ADDRESS" "name_ADDRESS"* { add
          to include list }
          add_member     address     "name_ADDRESS"       EXCLUDE
          "name_ADDRESS"* { add to exclude list }
          add_member service "name_SERVICE" "name_SERVICE"*



                   Last change: 15 March 2000                  10






Maintenance Commands                               ssadm-edit(1M)



          add_member        certificate        "name_CERTIFICATE"
          "name_CERTIFICATE"*

          *Multiple space-separated names may be specified  in  a
          single request.

          The following field may be necessary to uniquely  iden-
          tify  an  entry.   If so, it may be specified after the
          TYPE keyword:

          SCREEN "name_SCREEN"


     delete
          delete deletes the specified entry of the given TYPE.

          del[ete] address "name_ADDRESS"
          del[ete] screen "name_SUNSCREEN"
          del[ete] service "name_SERVICE"
          del[ete] interface "name_INTERFACE"
          del[ete] certificate "name_CERTIFICATE"
          del[ete] time "name_TIME"
          del[ete] rule #
          del[ete] nat #
          del[ete] accesslocal #
          del[ete] accessremote #
          del[ete] vpngateway #

          The following field may be necessary to uniquely  iden-
          tify  an  entry.   If so, it may be specified after the
          TYPE keyword except for the entries preceded by an  "*"
          above:

          SCREEN "name_SCREEN"


     delete_member
          delete_member deletes a member from a group or list.

          del[ete]_member address "name_ADDRESS"  "name_ADDRESS"*
          { from include list }
          del[ete]_member    address    "name_ADDRESS"    EXCLUDE
          "name_ADDRESS"* { from exclude list }
          del[ete]_member service "name_SERVICE" "name_SERVICE"*
          del[ete]_member     certificate      "name_CERTIFICATE"
          "name_CERTIFICATE"*

          *multiple space-separated names may be specified  in  a
          single request.

          The following field may be necessary to uniquely  iden-
          tify  an  entry.   If so, it may be specified after the



                   Last change: 15 March 2000                  11






Maintenance Commands                               ssadm-edit(1M)



          TYPE keyword:

          SCREEN "name_SCREEN"


     insert
          insert inserts a new  object  of  one  of  the  ordered
          (indexed)   types   in  a  specified  position  in  the
          corresponding list.

          insert rule index parameters...
          insert nat index parameters...
          insert accesslocal index parameters...
          insert accessremote index parameters...
          insert vpngateway index parameters...

          The index indicates the position  the  new  entry  will
          hold in the list after it is inserted.  The same param-
          eters used for add will be accepted for insert, follow-
          ing the index.


     move move moves an indexed entry from its  current  location
          in the ordered list to the new location.

          move rule oldindex newindex
          move nat oldindex newindex
          move accesslocal oldindex newindex
          move accessremote oldindex newindex
          move vpngateway oldindex newindex


     replace
          replace replaces an object at a specified index.

          replace rule index parameters...
          replace nat index parameters...
          replace accesslocal index parameters...
          replace accessremote index parameters...
          replace vpngateway index parameters...

          replace is similar to insert, except that  it  replaces
          the  entry at the specified index.  It is shorthand for
          an insert n / del n+1 pair of requests.  The same  syn-
          tax  used for add will be accepted for replace, follow-
          ing the index.


     refer
          refer determines if a named object of a given  TYPE  is
          referenced in any other objects.




                   Last change: 15 March 2000                  12






Maintenance Commands                               ssadm-edit(1M)



          refer address "name_ADDRESS"
          refer screen "name_SCREEN"
          refer service "name_SERVICE"
          refer stateengine "name_STATEENGINE"
          refer certificate "name_CERTIFICATE"
          refer time "name_TIME"
          refer vpn "name_VPN"


     referlist
          referlist displays a list of all objects that reference
          the specified named object of a given TYPE.

          referlist address "name_ADDRESS"
          referlist screen "name_SCREEN"
          referlist service "name_SERVICE"
          referlist stateengine "name_STATEENGINE"
          referlist certificate "name_CERTIFICATE"
          referlist time "name_TIME"
          referlist vpn "name_VPN"


     rename
          rename renames a  specified  named-object  of  a  given
          TYPE.

          rename address [SCREEN "name_SCREEN"] "name_ADDRESS" "name_ADDRESS"
          rename screen "name_SCREEN" "name_SCREEN"
          rename service [SCREEN "name_SCREEN"] "name_SERVICE" "name_SERVICE"
          rename interface [SCREEN "name_SCREEN"] "name_INTERFACE" "name_INTERFACE"
          rename certificate [SCREEN "name_SCREEN"] "name_CERTIFICATE" "name_CERTIFICATE"
          rename time [SCREEN "name_SCREEN"] "name_TIME" "name_TIME"

          If an entry already exists with the  new  name,  it  is
          replaced by this operation.


     renamereference
          renamereference renames all references to  a  specified
          named object of a given TYPE.

          renamereference address "name_ADDRESS" "name_ADDRESS"
          renamereference screen "name_SCREEN" "name_SCREEN"
          renamereference service "name_SERVICE" "name_SERVICE"
          renamereference certificate "name_CERTIFICATE" "name_CERTIFICATE"
          renamereference time "name_TIME" "name_TIME"
          renamereference vpn "name_VPN" "name_VPN"


     load load loads a policy into the editor.

          load "name_POLICY"



                   Last change: 15 March 2000                  13






Maintenance Commands                               ssadm-edit(1M)



          Any edits to the current policy must be saved  or  dis-
          carded before this operation will succeed.


     lock_status
          lock_status returns the status of the  lock  that  pro-
          tects  the  common  objects and the current policy from
          multiple editors.  If this editor  holds  the  lock,  a
          message  is printed indicating whether the lock is held
          for reading or for writing.  If  it  does  not  hold  a
          lock,  another process acquired a WRITE lock.  In which
          case, if that WRITE lock is still in  effect,  informa-
          tion  about  that  WRITER  is presented.  If that WRITE
          lock is no longer in effect,  then  lock  available  is
          returned,  indicating  that the current editor has lost
          its ability to modify the database.


     save save saves any current edits to the common objects  and
          policy.

          save
          save "name_POLICY"

          If a policy name is specified, then the current  policy
          is  written to the new name, but the old policy remains
          the current policy in the editor.


     saveas
          saveas saves the data currently in the editor  under  a
          new name.

          saveas
          saveas policy "name_POLICY"
          saveas policy "name_POLICY" registry Registry
          saveas policy "name_POLICY" registry "name_POLICY"
          saveas policy registry Registry

          These are the only supported legal requests.  The first
          saves the current policy data under the new name with a
          reference to the current Common  Objects.   The  second
          saves  the  policy  data  under  the new name and over-
          writes the current  Common  Objects  with  whatever  is
          currently  in  the editor.  This may impact other poli-
          cies and should be done with caution.  The third  saves
          the  contents  of the editor, policy objects and common
          objects, into a single self-contained  policy  file  of
          the  specified name.  The last saves the Common Objects
          currently in the editor as the Current  Common  Objects
          and  may  impact other policies and should be done with
          caution.



                   Last change: 15 March 2000                  14






Maintenance Commands                               ssadm-edit(1M)



     reload
          reload discards any and all edits (if  any  were  made)
          and reloads the data into the editor from the database.
          If another process has performed edits and  saved  them
          since  the  current editor process loaded its data, and
          the current editor process wants to perform  edits,  it
          must perform a reload first, to reacquire its read lock
          and ensure that no saved edits are lost.


     verify
          verify takes no arguments and "verifies" the  currently
          loaded policy.


     authuser
          authuser manipulates authorized user objects.

          authuser add name auserargs ...
          authuser delete name
          authuser print[,sortopt] [ name ]
          authuser names[,sortopt]

          sortopt is one of asc, desc, iasc,


     jar_hash
          jar_hash manipulates the list of JAR hashes used by the
          HTTP proxy.

          jar_hash add name hash
          jar_hash delete name
          jar_hash rename oldname newname
          jar_hash list
          jar_hash list_names

          add adds a named entry to the  collection  of  jar_hash
          objects.   del deletes a named jar_hash object.  rename
          renames a jar_hash object from  one  name  to  another.
          list  lists  the  names  and  hashes  of  the  jar_hash
          objects.   list_names  lists  just  the  names  of  the
          Wjar_hash objects.


     jar_sig
          jar_sig manipulates the list of JAR signatures used  by
          the HTTP proxy.

          jar_sig add name sig-hash
          jar_sig delete name
          jar_sig rename oldname newname
          jar_sig list



                   Last change: 15 March 2000                  15






Maintenance Commands                               ssadm-edit(1M)



          jar_sig list_names

          add adds a named entry to the  collection  of  jar_hash
          objects.   del deletes a named jar_hash object.  rename
          renames a jar_hash object from  one  name  to  another.
          list  lists  the  names  and  hashes  of  the  jar_hash
          objects.   list_names  lists  just  the  names  of  the
          jar_hash objects.


     logmacro
          logmacro manipulates logdump macro filtering objects.

          logmacro add macrokey macrovalue
          logmacro delete macrokey
          logmacro print[,sortopt] [ macrokey ]
          logmacro names[,sortopt]

          macrokey is of the form [ SYS=scrnname ] NAME=name

          macrovalue is of the form VALUE="macrobody".

          sortopt is one of asc, desc, iasc,


     mail_relay
          mail_relay manipulates the list of allowed  and  disal-
          lowed destination domains used by the SMTP proxy.

          mail_relay add relay_domain
          mail_relay add !relay_domain
          mail_relay del relay_domain
          mail_relay del !relay_domain
          mail_relay list

          add adds a domain  suffix  string  to  be  allowed  (or
          disallowed, if preceded by a '!') in recipients of mail
          messages.  del deletes a domain  suffix  string.   list
          produces a list of the current set of relay domain suf-
          fixes.


     mail_spam
          mail_spam manipulates the list  of  "spam"  domains  or
          addresses used by the SMTP proxy.

          mail_spam add spam_domain
          mail_spam add IPaddress
          mail_spam add IPstartaddress..IPendaddress
          mail_spam del spam_domain
          mail_spam del IPaddress
          mail_spam del IPstartaddress..IPendaddress



                   Last change: 15 March 2000                  16






Maintenance Commands                               ssadm-edit(1M)



          mail_spam list

          add using spam_domain adds a domain suffix string to be
          blocked  as  an  origin of incoming mail messages.  add
          can also be configured to use an IP address or range of
          addresses;  this  blocks  incoming  messages  from  the
          addressed hosts lacking registered domain  names.   del
          removes  a spam_domain suffix or IP address 'spam' res-
          trictor.  list produces a list of the  current  set  of
          'spam' restrictors.


     proxyuser
          proxyuser manipulates the list of proxy users.

          proxyuser add name puserargs ...
          proxyuser addmember grpname pmemname ...
          proxyuser delete name
          proxyuser deletemember grpname pmemname ...
          proxyuser print[,sortopt] [ name ]
          proxyuser names[,sortopt] [all|group|simple]

          sortopt is one of asc, desc, iasc,


     vars vars  manipulates  general-purpose  SunScreen  variable
          objects.

          vars add varkey varvalue
          vars delete varkey
          vars print[,sortopt] [ varkey ]
          vars names[,sortopt]

          varkey is of the form:
            [ SYS=scrnname ] [ PRG=prgname [ PGRP=pgrpname ] ] NAME=name

          macrovalue is of the form:
            VALUE="varvalue"
          or
            VALUES={ vartag=varvalue ... }

          sortopt is one of asc, desc, iasc,



     quit quit causes the editor to terminate  if  there  are  no
          unsaved changes.

          When the editor  is  used  interactively,  typing  quit
          twice  consecutively will cause the editor to terminate
          even if there are unsaved changes.




                   Last change: 15 March 2000                  17






Maintenance Commands                               ssadm-edit(1M)



     QUIT QUIT (typed in uppercase) causes  the  editor  to  ter-
          minate even if there are unsaved changes.

SEE ALSO
     ssadm(1M),  ssadm-activate(1M),   ssadm-active(1M),   ssadm-
     lock(1M),    ssadm-policy(1M),   intro(4),   accesslocal(4),
     accessremote(4),  address(4),  authuser(4),  certificate(4),
     interface(4),    jar_hash(4),    jar_sig(4),    logmacro(4),
     mail_relay(4),  mail_spam(4),   nat(4),   policy(4),   prox-
     yuser(4),  rule(4),  screen(4),  service(4), stateengine(4),
     time(4), vars(4), vpngateway(4)












































                   Last change: 15 March 2000                  18



