Assign the Sun Ray Management profile to a role, such as admin. If assigned to a new role, ensure it also gets the Software Installation profile. In this document, the role admin is used.  

The default profile is setup for use with CDROM media. Mount the CD with all privileges on /cdrom/cdrom0, making the mount point if it does not already exist: $ /usr/bin/mkdir -p /cdrom/cdrom0  

Allocate the CDROM via the Allocate Device option from front panel, but do not mount the CD. Rather, use the following command to mount the CD: $ /usr/bin/mount -F hsfs -o ro -S allowed=all /dev/dsk/c0t6d0s0 /cdrom/cdrom0  

To install the software via NFS or another directory, ensure all executable files have all allowed privileges.  Verify as follows: $ getfpriv utinstall utinstall FORCED: none ALLOWED: all

To install locally, set  allowed privileges as follows: $ /usr/bin/find . -type -f -a -perm -u+x -exec setfpriv -s -a all {} \;  

Install the software: $ /cdrom/cdrom0/utinstall

An enhanced packaging system will automatically install the files with allowed=all privileges.  

Assign the Sun Ray devices an admin_low template (this is the range of IP addresses planned for use by the utadm command).  Use the Security Family Tool within SMC to assign the Trusted Solaris system a tsol label. All other Sun Ray devices on the network get an admin_low label.  Here is an excerpt from the /etc/tnrhdb file after the changes have been made: 192.168.128.1:tsol 192.168.128.0:admin_low  

Set up the Sun Ray as outlined in the documentation. $ /opt/SUNWut/sbin/utconfig For dedicated interconnect, enter:  $ /opt/SUNWut/sbin/utadm -a <interface_name> For example:  $ /opt/SUNWut/sbin/utadm -a hme1 For shared (LAN) interconnect, enter: $ /opt/SUNWut/sbin/utadm -A <subnetwork> For example:  $ /opt/SUNWut/sbin/utadm -A 10.6.133.0  

The installation and configuration commands will create a utwww user account that is used to run cgi scripts.  To work, this account needs (at minimum) an admin_low label.  To set, assume the secadmin role and use the SMC User Manager to give the utwww account the Outside Accred right. Again, assign it at least an admin_low label.  After the change has been made, the user_attr  file has an additional entry as follows: utwww::::idlecmd=lock;lock_after_retries=no;idletime=5;labelview=internal,showsl;\ clearance=0x00000000000000000000000000000000000000000000000000000000000000000000;\ profiles=Outside Accred;min_label=0x00000000000000000000000000000000000000000000000000000000000000000000

The back slashes are not part of the data, but are shown here ease of view.  

Modify dtlogin and dtsession entries in /etc/pam.conf for Sun Ray use.  The updated entries should look as follows:  

 # pam_sunray.so added to dtlogin-SunRay by SunRay Server Software dtlogin-SunRay auth sufficient /opt/SUNWut/lib/pam_sunray.so dtlogin-SunRay    auth    requisite    /usr/lib/security/$ISA/pam_tp_auth.so.1 dtlogin-SunRay    auth    requisite    /usr/lib/security/$ISA/pam_unix.so.1 check_retries

dtlogin-SunRay    account    required    /usr/lib/security/$ISA/pam_roles.so.1 dtlogin-SunRay    account    required    /usr/lib/security/$ISA/pam_projects.so.1 dtlogin-SunRay    account    required    /usr/lib/security/$ISA/pam_unix.so.1 dtlogin-SunRay    account    required    /usr/lib/security/$ISA/pam_tsol.so.1

# pam_sunray.so added to dtsession-SunRay by SunRay Server Software dtsession-SunRay auth sufficient /opt/SUNWut/lib/pam_sunray.so syncondisplay dtsession-SunRay account required        /usr/lib/security/$ISA/pam_unix.so.1 dtsession-SunRay auth required /usr/lib/security/$ISA/pam_unix.so.1  

Reboot the system.  

The Sun Ray should now work properly. The administration console (http://host:1660) must be accessed at admin_low.