


Maintenance Commands                               ss_install(1M)



NAME
     ss_install - create an initial  configuration  for  a  newly
     installed Screen

SYNOPSIS
     ss_install

AVAILABILITY
     SUNWicgSS

DESCRIPTION
     The ss_install command is used to bootstrap a  SunScreen  to
     the  point  where  it  can  be administered using the normal
     administration procedures.

     This program is run automatically by the installer  GUI;  do
     not run ss_install if you used installer to install the Sun-
     Screen software.  The ss_install command should be used when
     installing a system without a monitor and keyboard attached.
     Only run ss_install after using pkgadd(1M)  to  install  the
     SUNWicgSA and SUNWicgSS packages.

     ss_install uses text-based prompts and  input  to  determine
     what initial configuration to create for the Screen.

     Some of the steps that the ss_install  command  may  perform
     are:  creating and installing a local key, creating rules to
     allow remote administration, and creating a default adminis-
     tration  user  and  password.  ss_install always creates and
     activates a configuration using  the  policy  name  Initial.
     After  ss_install  completes, the configuration can be modi-
     fied using the configuration editor, ssadm-edit(1M).

     ss_install will ask which security level to use for the ini-
     tial  configuration when you are installing in routing mode.
     There are three possible security levels for installing  the
     SunScreen  in routing mode.  Each security level corresponds
     to a different set of services permitted to pass  to,  from,
     or  through the Screen.  This security level is only for the
     initial configuration and can be changed at any  time  after
     installation by adding or removing the corresponding rules.

     The security levels are as follows:

     Restrictive
          This level of security disallows all traffic to,  from,
          and through the Screen, except encrypted administration
          traffic.  This level is best for deploying  the  Screen
          in  a  hostile  network  environment.  It requires that
          static routing and name resolution have been configured
          on the host.




                  Last change: 31 January 2000                  1






Maintenance Commands                               ss_install(1M)



     Secure
          This level disallows all traffic  to  and  through  the
          SunScreen,   but  it  allows  encrypted  administration
          traffic, common services from the Screen,  name  server
          resolution  traffic  (like  DNS  and  NIS), and routing
          (RIP). This level is a good starting  point  to  get  a
          Screen  up and running on a friendly network, where the
          Screen may not be a standalone machine and must  depend
          on NIS, DNS, or NFS to function properly.

     Permissive
          This level allows the same traffic as the Secure level,
          with  the  addition  of allowing inbound connections to
          the Screen itself, and allowing all traffic through the
          Screen.   This  security  level  is for installing Sun-
          Screen onto a host that has multiple network interfaces
          and  is acting as a router, or on a host that is acting
          as a server (for example for NFS, NIS, or WWW).

     See the SunScreen Installation  Guide  for  details  on  the
     differences  between  routing and stealth modes, host confi-
     guration requirements, and more details  of  the  ss_install
     command.

SEE ALSO
     pkgadd(1M),   ssadm-activate(1M),   ssadm-edit(1M),   ssadm-
     policy(1M)

NOTES
     After ss_install completes,  the  system  will  probably  be
     unstable  due to the loss of network connections; reboot the
     system to correct this.

     With the exception of the Restrictive security level, no  IP
     spoofing  protection  is  provided until the system has been
     properly configured.



















                  Last change: 31 January 2000                  2



