sckmd(1M)						  System Administration Commands						 sckmd(1M)

NAME

       sckmd - Sun Fire High-End system key management daemon

SYNOPSIS

       /usr/platform/SUNW,Sun-Fire-15000/lib/sckmd

DESCRIPTION

       sckmd  is  a server process that resides on a Sun Fire high-end system domain. sckmd maintains the Internet Protocol Security (IPsec) Secu-
       rity Associations (SAs) needed to secure the communication between the Sun Fire 15K System Controller (SC) and  the  cvcd(1M)  and  dcs(1M)
       daemons running on a Sun Fire 15K domain. See ipsec(7P) for a description of Security Associations.

       sckmd receives SAs from the SC and provides these SAs to the Security Association Databases (SADBs) using pf_key(7P).

       sckmd normally starts up at system boot time. Each domain supports only one running sckmd process at a time.

FILES

       /etc/inet/ipsecinit.conf        Configuration file for default system-wide IPsec policies

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+------------------------------------+
       |      ATTRIBUTE TYPE	     |		ATTRIBUTE VALUE 	  |
       +-----------------------------+------------------------------------+
       |Architecture		     |Sun Fire High-End systems 	  |
       +-----------------------------+------------------------------------+
       |Availability		     |SUNWsckmx.u, SUNWsckmu.u, SUNWsckmr |
       +-----------------------------+------------------------------------+

SEE ALSO

       cvcd(1M), dcs(1M), ipsecconf(1M), ipsecalgs(1M), attributes(5), ipsec(7P), ipsecah(7P), ipsecesp(7P), pf_key(7P)

	Sun Enterprise 10000 SSP Reference Manual

       System Management Services (SMS) Reference Manual

NOTES

       IPsec is used by Sun Fire high-end systems such as a Sun Fire 15K, to secure the communication between the SC, and the cvcd(1M) and dcs(1M)
       daemons running on a domain. System-wide IPsec policies for these daemons are configured on a domain with ipsecconf(1M).  Default  policies
       are defined when the SUNWsckmr package is installed on a Sun Fire high-end system domain at OS install time.

       Package	 SUNWsckmr   configures   default   system-wide   policies   for   cvcd(1M)  and  dcs(1M)  by  adding  the  following  entries	in
       /etc/inet/ipsecinit.conf:

       { dport sun-dr ulp tcp } permit
	       { auth_alg md5 }
       { sport sun-dr ulp tcp } apply
	       { auth_alg md5 sa unique }
       { dport cvc_hostd ulp tcp } permit
	       { auth_alg md5 }
       { sport cvc_hostd ulp tcp } apply
	       { auth_alg md5 sa unique }

       The cvc_hostd service represents cvcd(1M) and the sun-dr service represents dcs(1M) in the preceding entries.

       These policies conform to the format defined by ipsec(7P) and require and require IPsec AH protection using  the  HMAC-MD5  algorithm.  See
       ipsecah(7P).

       System-wide  policies  for  cvcd(1M) and dcs(1M) configured on a domain using ipsecconf(1M) must match the IPsec policies defined for these
       services on the SC. On an SC, IPsec policies for these services are defined by the SMS key management daemon. Refer to thekmd(1M) man  page
       in the System Management Services (SMS) Reference Manual.

       IPsec  encryption  or  authentication  with  encryption	can be enabled on the domain using the encr_algs and encr_auth_algs properties, as
       described in the ipsecconf(1M) manual page. For example, the following ipsecconf(1M) entries require IPsec ESP protection using the Triple-
       DES encryption algorithm and the HMAC-MD5 authentication algorithm.

       { dport cvc_hostd ulp tcp } permit
	       { encr_algs 3des encr_auth_algs md5 }
       { sport cvc_hostd ulp tcp } apply
	       { encr_algs 3des encr_auth_algs md5 sa unique }

       See  ipsecesp(7P)  for  more information on the IPsec ESP protocol. You can obtain a list of authentication  and  encryption algorithms and
       their properties by using the ipsecalgs(1M) command.

SunOS 5.10							    23 Oct 2003 							 sckmd(1M)