Skip Navigation Links
Oracle Solaris 11.1 Administration: Security Services
Oracle Solaris 11.1 Information Library
Search Scope:
This Document
Entire Library
Oracle Solaris 11.1 Administration: Security Services
February 2014
Explains how to administer security features on one or more Oracle Solaris systems.
Document Information
Preface
Part I Security Overview
1. Security Services (Overview)
System Security
Cryptographic Services
Authentication Services
Authentication With Encryption
Auditing
Security Policy
Part II System, File, and Device Security
2. Managing Machine Security (Overview)
Controlling Access to a Computer System
Maintaining Physical Security
Maintaining Login Control
Managing Password Information
Local Passwords
NIS Passwords
LDAP Passwords
Password Encryption
Password Algorithm Identifiers
Algorithms Configuration in the
policy.conf
File
Special System Accounts
Remote Logins
Controlling Access to Devices
Device Policy (Overview)
Device Allocation (Overview)
Controlling Access to Machine Resources
Address Space Layout Randomization
Limiting and Monitoring Superuser Access
Configuring Role-Based Access Control to Replace Superuser
Preventing Unintentional Misuse of System Resources
Setting the
PATH
Variable
Assigning a Restricted Shell to Users
Restricting Access to Data in Files
Restricting
setuid
Executable Files
Using the Secure by Default Configuration
Using Resource Management Features
Using Oracle Solaris Zones
Monitoring Use of Machine Resources
Monitoring File Integrity
Controlling Access to Files
Protecting Files With Encryption
Using Access Control Lists
Sharing Files Across Machines
Restricting
root
Access to Shared Files
Controlling Network Access
Network Security Mechanisms
Authentication and Authorization for Remote Access
Firewall Systems
Encryption and Firewall Systems
Reporting Security Problems
3. Controlling Access to Systems (Tasks)
Securing Logins and Passwords (Tasks)
Securing Logins and Passwords (Task Map)
How to Change the
root
Password
How to Display a User's Login Status
How to Display Users Without Passwords
How to Temporarily Disable User Logins
About Failed Logins
Changing the Default Algorithm for Password Encryption (Tasks)
How to Specify an Algorithm for Password Encryption
How to Specify a New Password Algorithm for an NIS Domain
How to Specify a New Password Algorithm for an LDAP Domain
Monitoring and Restricting
root
Access (Tasks)
How to Monitor Who Is Using the
su
Command
How to Restrict and Monitor
root
Logins
Controlling Access to System Hardware (Tasks)
How to Require a Password for SPARC Hardware Access
How to Disable a System's Abort Sequence
4. Virus Scanning Service (Tasks)
About Virus Scanning
About the Vscan Service
Using the Vscan Service (Tasks)
How to Enable Virus Scanning on a File System
How to Enable the Vscan Service
How to Add a Scan Engine
How to View Vscan Properties
How to Change Vscan Properties
How to Exclude Files From Virus Scans
5. Controlling Access to Devices (Tasks)
Configuring Device Policy (Tasks)
Configuring Device Policy (Task Map)
How to View Device Policy
How to Audit Changes in Device Policy
How to Retrieve IP MIB-II Information From a
/dev/*
Device
Managing Device Allocation (Tasks)
Managing Device Allocation (Task Map)
How to Enable Device Allocation
How to Authorize Users to Allocate a Device
How to View Allocation Information About a Device
How to Forcibly Allocate a Device
How to Forcibly Deallocate a Device
How to Change Which Devices Can Be Allocated
How to Audit Device Allocation
Allocating Devices (Tasks)
How to Allocate a Device
How to Mount an Allocated Device
How to Deallocate a Device
Device Protection (Reference)
Device Policy Commands
Device Allocation
Components of Device Allocation
Device Allocation Service
Device Allocation Rights Profiles
Device Allocation Commands
Authorizations for the Allocation Commands
Allocate Error State
device_maps
File
device_allocate
File
Device-Clean Scripts
Device-Clean Script for Tapes
Device-Clean Scripts for Diskettes and CD-ROM Drives
Device-Clean Script for Audio
Writing New Device-Clean Scripts
6. Verifying File Integrity by Using BART (Tasks)
BART (Overview)
BART Features
BART Components
BART Manifest
BART Report
BART Rules File
Using BART (Tasks)
BART Security Considerations
Using BART (Task Map)
How to Create a Control Manifest
How to Customize a Manifest
How to Compare Manifests for the Same System Over Time
How to Compare Manifests From Different Systems
How to Customize a BART Report by Specifying File Attributes
How to Customize a BART Report by Using a Rules File
BART Manifests, Rules Files, and Reports (Reference)
BART Manifest File Format
BART Rules File Format
Rules File Attributes
Quoting Syntax
BART Reporting
BART Output
7. Controlling Access to Files (Tasks)
Using UNIX Permissions to Protect Files
Commands for Viewing and Securing Files
File and Directory Ownership
UNIX File Permissions
Special File Permissions (
setuid
,
setgid
and Sticky Bit)
setuid
Permission
setgid
Permission
Sticky Bit
Default
umask
Value
File Permission Modes
Using Access Control Lists to Protect UFS Files
Protecting Executable Files From Compromising Security
Protecting Files (Tasks)
Protecting Files With UNIX Permissions (Task Map)
How to Display File Information
How to Change the Owner of a File
How to Change Group Ownership of a File
How to Change File Permissions in Symbolic Mode
How to Change File Permissions in Absolute Mode
How to Change Special File Permissions in Absolute Mode
Protecting Against Programs With Security Risk (Task Map)
How to Find Files With Special File Permissions
How to Disable Programs From Using Executable Stacks
Part III Roles, Rights Profiles, and Privileges
8. Using Roles and Privileges (Overview)
Role-Based Access Control (Overview)
RBAC: An Alternative to the Superuser Model
RBAC Elements and Basic Concepts
Privilege Escalation
RBAC Authorizations
Authorizations and Privileges
Privileged Applications and RBAC
Applications That Check UIDs and GIDs
Applications That Check for Privileges
Applications That Check Authorizations
RBAC Rights Profiles
RBAC Roles
Profile Shells and RBAC
Name Service Scope and RBAC
Security Considerations When Directly Assigning Security Attributes
Usability Considerations When Directly Assigning Security Attributes
Privileges (Overview)
Privileges Protect Kernel Processes
Privilege Descriptions
Administrative Differences on a System With Privileges
Privileges and System Resources
How Privileges Are Implemented
How Processes Get Privileges
Assigning Privileges
Expanding a User or Role's Privileges
Restricting a User or Role's Privileges
Assigning Privileges to a Script
Privileges and Devices
Privileges and Debugging
About RBAC in This Release
9. Using Role-Based Access Control (Tasks)
Using RBAC (Tasks)
Viewing and Using RBAC Defaults (Tasks)
Viewing and Using RBAC Defaults (Task Map)
How to View All Defined Security Attributes
How to View Your Assigned Rights
How to Assume a Role
How to Change the Security Attributes of a User
How to Use Your Assigned Administrative Rights
Customizing RBAC for Your Site (Tasks)
Initially Configuring RBAC (Task Map)
How to Plan Your RBAC Implementation
How to Create a Role
How to Assign a Role
How to Audit Roles
How to Create a Rights Profile
How to Clone and Modify a System Rights Profile
How to Create an Authorization
How to Add RBAC Properties to Legacy Applications
How to Troubleshoot RBAC and Privilege Assignment
Managing RBAC (Tasks)
Managing RBAC (Task Map)
How to Change the Password of a Role
How to Change the Security Attributes of a Role
How to Reorder Assigned Security Attributes
How to Restrict an Administrator to Explicitly Assigned Rights
How to Enable a User to Use Own Password to Assume a Role
How to Change the
root
Role Into a User
Using Privileges (Tasks)
How to List the Privileges on the System
How to Determine the Privileges That You Have Been Directly Assigned
How to Determine the Privileged Commands That You Can Run
How to Determine the Privileges on a Process
How to Determine Which Privileges a Program Requires
How to Apply Extended Privilege Policy to a Port
How to Run a Shell Script With Privileged Commands
10. Security Attributes in Oracle Solaris (Reference)
Rights Profiles
Viewing the Contents of Rights Profiles
Order of Search for Assigned Security Attributes
Authorizations
Authorization Naming Conventions
Delegation Authority in Authorizations
RBAC Databases
RBAC Databases and the Naming Services
user_attr
Database
auth_attr
Database
prof_attr
Database
exec_attr
Database
policy.conf
File
RBAC Commands
Commands That Manage RBAC
Selected Commands That Require Authorizations
Privileges
Administrative Commands for Handling Privileges
Files With Privilege Information
Privileges and Auditing
Prevention of Privilege Escalation
Legacy Applications and the Privilege Model
Part IV Cryptographic Services
11. Cryptographic Framework (Overview)
Introduction to the Cryptographic Framework
Terminology in the Cryptographic Framework
Scope of the Cryptographic Framework
Administrative Commands in the Cryptographic Framework
User-Level Commands in the Cryptographic Framework
Binary Signatures for Third-Party Software
Plugins to the Cryptographic Framework
Cryptographic Services and Zones
Cryptographic Framework and FIPS-140
Cryptographic Framework and the SPARC T-Series Servers in This Release
12. Cryptographic Framework (Tasks)
Protecting Files With the Cryptographic Framework (Tasks)
Protecting Files With the Cryptographic Framework (Task Map)
How to Generate a Symmetric Key by Using the
pktool
Command
How to Compute a Digest of a File
How to Compute a MAC of a File
How to Encrypt and Decrypt a File
Administering the Cryptographic Framework (Tasks)
Administering the Cryptographic Framework (Task Map)
How to List Available Providers
How to Add a Software Provider
How to Use the Cryptographic Framework in FIPS-140 Mode
How to Prevent the Use of a User-Level Mechanism
How to Prevent the Use of a Kernel Software Provider
How to List Hardware Providers
How to Disable Hardware Provider Mechanisms and Features
How to Refresh or Restart All Cryptographic Services
13. Key Management Framework
Managing Public Key Technologies (Overview)
Key Management Framework Utilities
KMF Policy Management
KMF Plugin Management
KMF Keystore Management
Using the Key Management Framework (Tasks)
Using the Key Management Framework (Task Map)
How to Create a Certificate by Using the
pktool gencert
Command
How to Import a Certificate Into Your Keystore
How to Export a Certificate and Private Key in PKCS #12 Format
How to Generate a Passphrase by Using the
pktool setpin
Command
How to Generate a Key Pair by Using the
pktool genkeypair
Command
How to Sign a Certificate Request by Using the
pktool signcsr
Command
How to Manage Third-Party Plugins in KMF
Part V Authentication Services and Secure Communication
14. Using Pluggable Authentication Modules
PAM (Overview)
Benefits of Using PAM
Introduction to the PAM Framework
Changes to PAM for This Release
PAM (Tasks)
PAM (Task Map)
Planning for Your PAM Implementation
How to Add a PAM Module
How to Prevent Rhost-Style Access From Remote Systems With PAM
How to Log PAM Error Reports
How to Assign a Customized PAM Policy to a User
How to Assign a New Rights Policy to All Users
PAM Configuration (Reference)
PAM Configuration Search Order
PAM Configuration File Syntax
Per User Authentication Policy
How PAM Stacking Works
PAM Stacking Example
15. Using Secure Shell
Secure Shell (Overview)
Secure Shell Authentication
Secure Shell in the Enterprise
Secure Shell and the OpenSSH Project
Secure Shell and FIPS-140
Configuring Secure Shell (Tasks)
Configuring Secure Shell (Task Map)
How to Set Up Host-Based Authentication for Secure Shell
How to Configure Port Forwarding in Secure Shell
How to Create User and Host Exceptions to Secure Shell Defaults
How to Create an Isolated Directory for
sftp
Files
Using Secure Shell (Tasks)
Using Secure Shell (Task Map)
How to Generate a Public/Private Key Pair for Use With Secure Shell
How to Change the Passphrase for a Secure Shell Private Key
How to Log In to a Remote Host With Secure Shell
How to Reduce Password Prompts in Secure Shell
How to Remotely Administer ZFS With Secure Shell
How to Use Port Forwarding in Secure Shell
How to Copy Files With Secure Shell
How to Set Up Default Secure Shell Connections to Hosts Outside a Firewall
16. Secure Shell (Reference)
A Typical Secure Shell Session
Session Characteristics in Secure Shell
Authentication and Key Exchange in Secure Shell
Acquiring GSS Credentials in Secure Shell
Command Execution and Data Forwarding in Secure Shell
Client and Server Configuration in Secure Shell
Client Configuration in Secure Shell
Server Configuration in Secure Shell
Keywords in Secure Shell
Host-Specific Parameters in Secure Shell
Secure Shell and Login Environment Variables
Maintaining Known Hosts in Secure Shell
Secure Shell Files
Secure Shell Commands
17. Using Simple Authentication and Security Layer
SASL (Overview)
SASL (Reference)
SASL Plug-ins
SASL Environment Variable
SASL Options
18. Network Services Authentication (Tasks)
Overview of Secure RPC
NFS Services and Secure RPC
Kerberos Authentication
DES Encryption With Secure NFS
Diffie-Hellman Authentication and Secure RPC
Implementation of Diffie-Hellman Authentication
Generating the Public Keys and Secret Keys for Secure RPC
Running the
keylogin
Command for Secure RPC
Generating the Conversation Key for Secure RPC
Initially Contacting the Server in Secure RPC
Decrypting the Conversation Key in Secure RPC
Storing Information on the Server in Secure RPC
Returning the Verifier to the Client in Secure RPC
Authenticating the Server in Secure RPC
Handling Transactions in Secure RPC
Administering Authentication With Secure RPC (Tasks)
Administering Secure RPC (Task Map)
How to Restart the Secure RPC Keyserver
How to Set Up a Diffie-Hellman Key for an NIS Host
How to Set Up a Diffie-Hellman Key for an NIS User
How to Share NFS Files With Diffie-Hellman Authentication
Part VI Kerberos Service
19. Introduction to the Kerberos Service
What Is the Kerberos Service?
How the Kerberos Service Works
Initial Authentication: the Ticket-Granting Ticket
Subsequent Kerberos Authentications
Kerberos Remote Applications
Kerberos Principals
Kerberos Realms
Kerberos Servers
Kerberos Security Services
Components of Various Kerberos Releases
Kerberos Components
About Kerberos in this Release
20. Planning for the Kerberos Service
Why Plan for Kerberos Deployments?
Planning Kerberos Realms
Realm Names
Number of Realms
Realm Hierarchy
Mapping Host Names Onto Realms
Client and Service Principal Names
Ports for the KDC and Admin Services
The Number of Slave KDCs
Mapping GSS Credentials to UNIX Credentials
Automatic User Migration to a Kerberos Realm
Which Database Propagation System to Use
Clock Synchronization Within a Realm
Client Configuration Options
Improving Client Login Security
KDC Configuration Options
Trusts of Services for Delegation
Kerberos Encryption Types
Online Help URL in the Graphical Kerberos Administration Tool
21. Configuring the Kerberos Service (Tasks)
Configuring the Kerberos Service (Task Map)
Configuring Additional Kerberos Services (Task Map)
Configuring KDC Servers
How to Automatically Configure a Master KDC
How to Interactively Configure a Master KDC
How to Manually Configure a Master KDC
How to Configure a KDC to Use an LDAP Data Server
How to Automatically Configure a Slave KDC
How to Interactively Configure a Slave KDC
How to Manually Configure a Slave KDC
How to Refresh the Ticket-Granting Service Keys on a Master Server
Configuring Cross-Realm Authentication
How to Establish Hierarchical Cross-Realm Authentication
How to Establish Direct Cross-Realm Authentication
Configuring Kerberos Network Application Servers
How to Configure a Kerberos Network Application Server
How to Use the Generic Security Service With Kerberos When Running FTP
Configuring Kerberos NFS Servers
How to Configure Kerberos NFS Servers
How to Create a Credential Table
How to Add a Single Entry to the Credential Table
How to Provide Credential Mapping Between Realms
How to Set Up a Secure NFS Environment With Multiple Kerberos Security Modes
Configuring Kerberos Clients
Configuring Kerberos Clients (Task Map)
How to Create a Kerberos Client Installation Profile
How to Automatically Configure a Kerberos Client
How to Interactively Configure a Kerberos Client
How to Configure a Kerberos Client for an Active Directory Server
How to Manually Configure a Kerberos Client
How to Disable Verification of the Ticket-Granting Ticket
How to Access a Kerberos Protected NFS File System as the
root
User
How to Configure Automatic Migration of Users in a Kerberos Realm
How to Configure Account Lockout
How to Automatically Renew All Ticket-Granting Tickets (TGTs)
Synchronizing Clocks Between KDCs and Kerberos Clients
Swapping a Master KDC and a Slave KDC
How to Configure a Swappable Slave KDC
How to Swap a Master KDC and a Slave KDC
Administering the Kerberos Database
Backing Up and Propagating the Kerberos Database
The
kpropd.acl
File
The
kprop_script
Command
How to Back Up the Kerberos Database
How to Restore the Kerberos Database
How to Convert a Kerberos Database After a Server Upgrade
How to Reconfigure a Master KDC to Use Incremental Propagation
How to Reconfigure a Slave KDC to Use Incremental Propagation
How to Configure a Slave KDC to Use Full Propagation
How to Verify That the KDC Servers Are Synchronized
How to Manually Propagate the Kerberos Database to the Slave KDCs
Setting Up Parallel Propagation
Configuration Steps for Setting Up Parallel Propagation
Administering the Stash File
How to Remove a Stash File
How to Employ a New Master Key
Managing a KDC on an LDAP Directory Server
How to Mix Kerberos Principal Attributes in a Non-Kerberos Object Class Type
How to Destroy a Realm on an LDAP Directory Server
Increasing Security on Kerberos Servers
How to Restrict Access to KDC Servers
How to Use a Dictionary File to Increase Password Security
22. Kerberos Error Messages and Troubleshooting
Kerberos Error Messages
SEAM Tool Error Messages
Common Kerberos Error Messages (A-M)
Common Kerberos Error Messages (N-Z)
Kerberos Troubleshooting
How to Identify Problems With Key Version Numbers
Problems With the Format of the
krb5.conf
File
Problems Propagating the Kerberos Database
Problems Mounting a Kerberized NFS File System
Problems Authenticating as the
root
User
Observing Mapping From GSS Credentials to UNIX Credentials
Using DTrace With the Kerberos Service
23. Administering Kerberos Principals and Policies (Tasks)
Ways to Administer Kerberos Principals and Policies
SEAM Tool
Command-Line Equivalents of the SEAM Tool
The Only File Modified by the SEAM Tool
Print and Online Help Features of the SEAM Tool
Working With Large Lists in the SEAM Tool
How to Start the SEAM Tool
Administering Kerberos Principals
Administering Kerberos Principals (Task Map)
Automating the Creation of New Kerberos Principals
How to View the List of Kerberos Principals
How to View a Kerberos Principal's Attributes
How to Create a New Kerberos Principal
How to Duplicate a Kerberos Principal
How to Modify a Kerberos Principal
How to Delete a Kerberos Principal
How to Set Up Defaults for Creating New Kerberos Principals
How to Modify the Kerberos Administration Privileges
Administering Kerberos Policies
Administering Kerberos Policies (Task Map)
How to View the List of Kerberos Policies
How to View a Kerberos Policy's Attributes
How to Create a New Kerberos Policy
How to Duplicate a Kerberos Policy
How to Modify a Kerberos Policy
How to Delete a Kerberos Policy
SEAM Tool Reference
SEAM Tool Panel Descriptions
Using the SEAM Tool With Limited Kerberos Administration Privileges
Administering Keytab Files
Administering Keytab Files (Task Map)
How to Add a Kerberos Service Principal to a Keytab File
How to Remove a Service Principal From a Keytab File
How to Display the Keylist (Principals) in a Keytab File
How to Temporarily Disable Authentication for a Service on a Host
24. Using Kerberos Applications (Tasks)
Kerberos Ticket Management
Do You Need to Worry About Tickets?
Creating a Kerberos Ticket
Viewing Kerberos Tickets
Destroying Kerberos Tickets
Kerberos Password Management
Advice on Choosing a Password
Changing Your Password
Granting Access to Your Account
Kerberos User Commands
Overview of Kerberized Commands
Forwarding Kerberos Tickets
Using Kerberized Commands (Examples)
25. The Kerberos Service (Reference)
Kerberos Files
Kerberos Commands
Kerberos Daemons
Kerberos Terminology
Kerberos-Specific Terminology
Authentication-Specific Terminology
Types of Tickets
Ticket Lifetimes
Kerberos Principal Names
How the Kerberos Authentication System Works
How the Kerberos Service Interacts With DNS and the
nsswitch
Service
Gaining Access to a Service Using Kerberos
Obtaining a Credential for the Ticket-Granting Service
Obtaining a Credential for a Server
Obtaining Access to a Specific Service
Using Kerberos Encryption Types
Using the
gsscred
Table
Notable Differences Between Oracle Solaris Kerberos and MIT Kerberos
Part VII Auditing in Oracle Solaris
26. Auditing (Overview)
What Is Auditing?
Audit Terminology and Concepts
Audit Events
Audit Classes and Preselection
Audit Records and Audit Tokens
Audit Plugin Modules
Audit Logs
Storing and Managing the Audit Trail
Ensuring Reliable Time Stamps
Managing a Remote Repository
How Is Auditing Related to Security?
How Does Auditing Work?
How Is Auditing Configured?
Auditing on a System With Oracle Solaris Zones
About the Audit Service in This Release
27. Planning for Auditing
Planning Auditing (Tasks)
How to Plan Auditing in Zones
How to Plan Who and What to Audit
How to Plan Disk Space for Audit Records
How to Prepare to Stream Audit Records to Remote Storage
Understanding Audit Policy
Controlling Auditing Costs
Cost of Increased Processing Time of Audit Data
Cost of Analysis of Audit Data
Cost of Storage of Audit Data
Auditing Efficiently
28. Managing Auditing (Tasks)
Configuring the Audit Service (Tasks)
Configuring the Audit Service (Task Map)
How to Display Audit Service Defaults
How to Preselect Audit Classes
How to Configure a User's Audit Characteristics
How to Change Audit Policy
How to Change Audit Queue Controls
How to Configure the
audit_warn
Email Alias
How to Add an Audit Class
How to Change an Audit Event's Class Membership
Configuring Audit Logs (Tasks)
Configuring Audit Logs (Task Map)
How to Create ZFS File Systems for Audit Files
How to Assign Audit Space for the Audit Trail
How to Send Audit Files to a Remote Repository
How to Configure a Remote Repository for Audit Files
How to Configure
syslog
Audit Logs
Configuring the Audit Service in Zones (Tasks)
How to Configure All Zones Identically for Auditing
How to Configure Per-Zone Auditing
Enabling and Disabling the Audit Service (Tasks)
How to Refresh the Audit Service
How to Disable the Audit Service
How to Enable the Audit Service
Managing Audit Records on Local Systems (Tasks)
Managing Audit Records on Local Systems (Task Map)
How to Display Audit Record Definitions
How to Merge Audit Files From the Audit Trail
How to Select Audit Events From the Audit Trail
How to View the Contents of Binary Audit Files
How to Clean Up a
not_terminated
Audit File
How to Prevent Audit Trail Overflow
Troubleshooting the Audit Service (Tasks)
Troubleshooting the Audit Service (Task Map)
How to Determine That Auditing Is Running
How to Lessen the Volume of Audit Records That Are Produced
How to Audit All Commands by Users
How to Find Audit Records of Changes to Specific Files
How to Update the Preselection Mask of Logged In Users
How to Prevent the Auditing of Specific Events
How to Limit the Size of Binary Audit Files
How to Compress Audit Files on a Dedicated File System
How to Audit Logins From Other Operating Systems
How to Audit FTP and SFTP File Transfers
29. Auditing (Reference)
Audit Service
Audit Service Man Pages
Rights Profiles for Administering Auditing
Auditing and Oracle Solaris Zones
Audit Configuration Files and Packaging
Audit Classes
Audit Class Syntax
Audit Plugins
Audit Remote Server
Audit Policy
Audit Policies for Asynchronous and Synchronous Events
Process Audit Characteristics
Audit Trail
Conventions for Binary Audit File Names
Audit Record Structure
Audit Record Analysis
Audit Token Formats
acl
Token
argument
Token
attribute
Token
cmd
Token
exec_args
Token
exec_env
Token
file
Token
fmri
Token
group
Token
header
Token
ip address
Token
ip port
Token
ipc
Token
IPC_perm
Token
path
Token
path_attr
Token
privilege
Token
process
Token
return
Token
sequence
Token
socket
Token
subject
Token
text
Token
trailer
Token
use of authorization
Token
use of privilege
Token
user
Token
xclient
Token
zonename
Token
Glossary
Index
Numbers and Symbols
A
B
C
D
E
F
G
H
I
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Z