sckmd(1M)

NAME

     sckmd - Sun Fire High-End system key management daemon

SYNOPSIS

     /usr/platform/SUNW,Sun-Fire-15000/lib/sckmd

DESCRIPTION

     sckmd is a server process that resides on a Sun  Fire  high-
     end  system  domain.  sckmd  maintains the Internet Protocol
     Security  (IPsec)  Security  Associations  (SAs)  needed  to
     secure  the  communication  between  the Sun Fire 15K System
     Controller (SC) and the cvcd(1M) and dcs(1M) daemons running
     on a Sun Fire 15K domain. See ipsec(7P) for a description of
     Security Associations.

     sckmd receives SAs from the SC and provides these SAs to the
     Security Association Databases (SADBs) using pf_key(7P).

     sckmd normally starts up at system boot  time.  Each  domain
     supports only one running sckmd process at a time.

FILES

     /etc/inet/ipsecinit.conf
           Configuration file for default system-wide IPsec poli-
           cies

ATTRIBUTES

     See attributes(5) for descriptions of the  following  attri-
     butes:

     ___________________________________________________________________
    |       ATTRIBUTE TYPE        |           ATTRIBUTE VALUE          |
    |_____________________________|____________________________________|
    | Architecture                | Sun Fire High-End systems          |
    |_____________________________|____________________________________|
    | Availability                | SUNWsckmx.u, SUNWsckmu.u, SUNWsckmr|
    |_____________________________|____________________________________|

SEE ALSO

     cvcd(1M),     dcs(1M),     ipsecconf(1M),     attributes(5),
     authmd5h(7M), encr3des(7M), ipsec(7P), pf_key(7P)

      Sun Enterprise 10000 SSP Reference Manual

     System Management Services (SMS) Reference Manual

NOTES

     IPsec is used by Sun Fire high-end systems  such  as  a  Sun
     Fire  15K,  to  secure the communication between the SC, and
     the cvcd(1M)  and  dcs(1M)  daemons  running  on  a  domain.
     System-wide  IPsec policies for these daemons are configured
     on a domain with ipsecconf(1M). Default policies are defined
     when  the SUNWsckmr package is installed on a Sun Fire high-
     end system domain at OS install time.

     Package SUNWsckmr configures  default  system-wide  policies
     for  cvcd(1M) and dcs(1M) by adding the following entries in
     /etc/inet/ipsecinit.conf:

     { dport sun-dr ulp tcp } permit
             { auth_alg md5 }
     { sport sun-dr ulp tcp } apply
             { auth_alg md5 sa unique }
     { dport cvc_hostd ulp tcp } permit
             { auth_alg md5 }
     { sport cvc_hostd ulp tcp } apply
             { auth_alg md5 sa unique }

     The cvc_hostd service represents  cvcd(1M)  and  the  sun-dr
     service represents dcs(1M) in the preceding entries.

     These policies conform to the format  defined  by  ipsec(7P)
     and require HMAC-MD5 authentication. See authmd5h(7M).

     System-wide policies for cvcd(1M) and dcs(1M) configured  on
     a  domain  using ipsecconf(1M) must match the IPsec policies
     defined for these services on the SC. On an SC, IPsec  poli-
     cies  for  these services are defined by the SMS key manage-
     ment daemon. Refer to thekmd(1M)  man  page  in  the  System
     Management Services (SMS) Reference Manual.

     IPsec encryption or authentication with  encryption  can  be
     enabled on the domain using the encr_algs and encr_auth_algs
     properties, as described in the ipsecconf(1M)  manual  page.
     For  example,  the  following  ipsecconf(1M) entries require
     Triple-DES and HMAC-MD5 authentication for the network  con-
     sole cvcd(1M) service:

     { dport cvc_hostd ulp tcp } permit
             { encr_algs 3des encr_auth_algs md5 }
     { sport cvc_hostd ulp tcp } apply
             { encr_algs 3des encr_auth_algs md5 sa unique }

     See   encr3des(7M)   for   Triple-DES   authentication   and
     authmd5h(7M) for HMAC-M5 authentication.