Revision as of 14:14, 20 July 2011

Solaris 10 Update 9

• Disable services. Things like sma will be enabled by cfengine for monitoring FMD over snmp, but let's assume we're not going to do that, and make the zone as bare-bones to start with.

for foo in webconsole cde-printinfo cde-login dmi snmpdx sendmail rpc_ticotsord cde-spc stlisten finger stdiscover telnet ftp shell:default shell:kshell rquota rlogin cde-ttdbserver fc-cache rusers cde-calendar-manager smserver xfs stfsloader rstat wbem nfs/mapid nfs/status nfs/cbd ogl-select ppd-cache-update sac sma seaport ; do svcadm disable $foo ; done ;

• Edit /etc/passwd to move root's homedir to /root
• Edit /etc/security/policy.conf to change CRYPT_DEFAULT and reset root's password
• Install cfenging, if applicable:

mkdir -p /var/cfengine/inputs
mv update.conf /var/cfengine/inputs/
/opt/csw/sbin/cfkey
/opt/csw/sbin/cfagent -qv -f update.conf
/opt/csw/sbin/cfagent -qv