svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
identity(8s)
identity(8s) SMF Services identity(8s)
NAME
identity - System Identity configuration
SYNOPSIS
svc:/system/identity
DESCRIPTION
The SMF service svc:/system/identity configures the basic network iden‐
tity (names) of the Oracle Solaris instance. This includes its node‐
name, RPC domainname and the default set of X.509 certificates used for
the Remote Administration Daemon (RAD), WebUI, and possibly the OpenL‐
DAP server (slapd(8)) (see ldapservercfg(8)).
The service is composed of multiple instances:
o svc:/system/identity:node
Sets the hostname/nodename.
o svc:/system/identity:domain
Sets the RPC domainname.
o svc:/system/identity:cert
Deploys or creates the X.509 certificates for WebUI and RAD
connections using the TLS transport.
o svc:/system/identity:cert-expiry
X.509 certificate expiry check.
o svc:/system/identity:version
Updates the value used for 'uname -v'.
OPTIONS
The following configuration properties apply to the cert instance:
certificate/generate
Generate a new local Certificate Authority and host certifiate is‐
sued by the host CA. This option is true by default and is automat‐
ically set to false after the certificates have been generated and
loaded into the SMF service.
certificate/add_ip_subject_altname
Include IP address Subject Alternative Name entries in the CSR and
local CA generated X.509 certificate. This option is set to true by
default. Note that RFC 6125 generally advises against the use of IP
addresses in X.509 certificates.
The following configuration properties apply to the cert-expiry in‐
stance:
config/warn_days
If there is any host certificate that expired or is about to expire
within the configured number of days, the instance will enter de‐
graded mode. In such case, the instance will restart the cert in‐
stance to re-issue the system identity certificate, if that is the
one that expired.
EXAMPLES
Example 1 Regenerating the local host CA and host keys and certificates
# svccfg -s system/identity:cert delcust
# svcadm refresh system/identity:cert
# svcadm restart -s system/identity:cert
Example 2 View the host X.509 certificate
# pktool list keystore=file dir=/etc/certs/localhost
Certificates:
1) X.509 certificate
Filename: /etc/certs/localhost/host.crt
Subject: CN=myhost.example.com
Issuer: O=Host Root CA, CN=myhost
Not Before: Feb 23 10:56:00 2021 GMT
Not After: Feb 24 10:56:00 2022 GMT
Serial: 0xF84CDC4E7326
Signature Algorithm: sha256WithRSAEncryption
X509v3 Subject Alternative Name:
DNS:myhost.example.com
DNS:myhost
IP Address:10.1.208.223
IP Address:192.168.0.1
X509v3 Extended Key Usage:
TLS Web Server Authentication
SHA1 Certificate Fingerprint:
97:30:b0:7c:63:05:19:78:55:d4:12:81:5f:e3:2c:5d:00:d1:31:b6
Example 3 Specifying a certificate DN
For the case where the host can not determine its own fully qualified
domain name itself, maybe because it is behind NAT or uses a different
DNS to the clients, the value of the DN can be provided:
# svccfg -s system/identity:cert delcust
# svccfg -s system/identity:cert setprop certificate/subject \
= service.example.com
# svcadm refresh system/identity:cert
# svcadm restart -sr system/identity:cert
Example 4 Setting CA issued X.509 Certificates
By default the system will generate a local Certificate Authority (CA)
and issue a host certificate from it. This is used as the default TLS
server certificate for svc:/system/webui/server and svc:/system/rad:re‐
mote services.
Deployments that can have a certificate issued from a Certificate Au‐
thority (CA) should use the following procedure to use that certificate
instead, substituting appropriate filenames:
# SVC=svc:/system/identity:cert
# svccfg -s $SVC setprop certificate/cert/pem_value \
= astring: "$(cat /path/to/signed/certificate.crt)"
# svccfg -s $SVC setprop certificate/cert/private_key/pem_value \
= astring: "$(cat /path/to/signed/certificate.key)"
# svccfg -s $SVC setprop certificate/ca/pem_value \
= astring: "$(cat /path/to/issuer/certificate.crt)"
# svcadm refresh $SVC
# svcadm restart -s $SVC
Restarting svc:/system/identity:cert results in the following service
instances being restarted:
o svc:/network/ldap/identity:openldap (When svc:/net‐
work/ldap/identity:openldap is configured to use identity
private key, see ldapservercfg(8).)
o svc:/system/webui/server
o svc:/system/rad:remote
o svc:/system/ca-certificates:default
SEE ALSO
hostname(1), pktool(1), uname(1), webui-service(7), domainname(8),
ldapservercfg(8), slapd(8oldap), svcadm(8), svccfg(8)
HISTORY
The certificate/add_ip_subject_altname property was added in the Oracle
Solaris 11.4.33 release.
The svc:/system/identity:cert, svc:/system/identity:cert-expiry, and
svc:/system/identity:version instances were added in the Oracle Solaris
11.4.0 release.
The svc:/system/identity:domain and svc:/system/identity:node instances
were introduced in the Solaris 10 3/05 release.
Oracle Solaris 11.4 11 Dec 2024 identity(8s)