<--back

Solaris 8 Installation Checklist

• Install from the "Solaris 8 Software CD 1", not from the "Installation CD".
• Install "Entire Distribution", if you got enough space. Otherwise, you won't get all the manual pages and C header files (which are needed for compiling programs).
• Make separate slices for:
  • /, at least 100Mb. This partition is critical to boot the system. If it cannot be mounted read-only, your system will simply hang.
  • /usr, very large. Solaris installs a lot of stuff there.
  • /var, very large. This is the storage for all log files and for the mail spool (if you have a MDA which delivers to /var/mail/$USER).

After installation, you should immediatly do:

• Patch your system. Either get the latest patch cluster from sunsolve.sun.com or use autopatch.
• Edit /etc/vfstab and add logging to all ufs volumes mount options.
• Set default UMASK in /etc/default/login and /etc/default/su.
• Set PATH and SUPATH in /etc/default/login and /etc/default/su.
  • Make sure, "." is not listed there.
  • Don't put any paths there, where users or attackers might install executables.

• Add the domain name of your machine to /etc/hosts:

  	192.168.0.1 hostname hostname.yourdomain.tld loghost
  	

• Add your domain name to /etc/defaultdomain.
• Add your default gateway to /etc/defaultrouter. Otherwise, in.routed and in.ndpd get started.
• Change TCP_STRONG_ISS in /etc/default/inetinit to "2".

• Deinstall the pre-installed Sendmail and install a real MTA. Or, at least, install the latest Sendmail version from source (SUNs version is slightly broken).
• Create ~root/.rhosts and /etc/hosts.equiv. Leave them empty. Change their permissions to 000.
• Edit /etc/pam.conf and comment out the entries for the old and obsolete r* services.
• Edit /etc/vfstab. Decide wheter to set the mount option nosuid for all volumes with user home directories. Decide, wheter you can mount / or /usr read-only (mount option: ro).
• Change to /etc/rc2.d and rename some files, so they don't get executed at startup (for example, rename the file S47asppp to no_S47asppp). For a server only system, I have:
  • no_S47asppp
  • no_S70uucp
  • no_S71ldap.client
  • no_S71rpc
  • no_S72autoinstall
  • no_S72slpd
  • no_S73cachefs.daemon
  • no_S73nfs.client
  • no_S74autofs
  • no_S76nscd
  • no_S80lp
  • no_S80spc
  • no_S85power
  • no_S88sendmail
  • no_S89bdconfig
  • no_S92volmgt
  • no_S99dtlogin
• Do the same for /etc/rc3.d:
  • no_S15nfs.server
  • no_S50apache
  • no_S76snmpdx
  • no_S77dmi
• Remove sac from /etc/inittab.
• Add this to /etc/system:

  # no stacksmashing, please
  set noexec_user_stack = 1
  set noexec_user_stack_log = 1
  	

• Edit /etc/nsswitch.conf. Make sure, ipnodes is set to files dns.
• You need to create a /etc/hostname6 file, to have a properly set up IPv6 localhost. For example, I have:

  % cat /etc/hostname6.ip.tun0
  plumb tsrc 195.134.144.50 tdst 212.19.192.219 up
  addif 3ffe:8114:1000::491 3ffe:8114:1000::490 up
  addif 3ffe:8114:2000:12E0::100/60 up
  	

  This sets up my IPv6-in-IPv4 tunnel. And it sets up the IPv6 localhost, too (this gets automatically done trough /etc/rc2.d/S69inet).

• Run catman -w to be able to do keyword searches with man -k (this builds the windex database).
• Decide wheter you want to change root's home directory to something else, like /root in /etc/passwd. Then you will have a lot fewer files in your /. Make /root 700.
• Set up root's .profile:

  stty erase ^H
  stty istrip
  PATH=/usr/bin:/usr/sbin:/usr/ucb:/etc:/usr/local/bin
  PS1=`hostname`'# '
  EDITOR=vi
  export PATH PS1 EDITOR
  	

  Note: ^H means ^V+^H.

Last changed: Sunday, 09-Mar-2003 19:32:09 CET
Send comments to thomasb+www@trash.net