Softpanorama
May the source be with you, but remember the KISS principle ;-)

Contents Bulletin Scripting in shell and Perl Network troubleshooting History Humor

Solaris 9 RC Scripts

News Recommended
Links
Open Boot Solaris Run Levels SMF Startup Files
Serial Console on Solaris ALOM Boot Process History Humor Etc

Any installation of Solaris loads many packages that are not needed for a server to function. However, even if you remove unneeded packages, there are several startup services which can be disabled. As part of your minimalization process, you want to reduce number of processes and services running on your server. Some of these unneeded services can pose a potential security risk. There are two main places to configure which services are active: the /etc/inetd.conf file and the /etc/rc.X/ directories.

inetd.conf

This file specifies which ports the inetd daemon will listen for. You eliminate uneccessary services by commenting them out. There are many web tutorials on configuring the inetd.conf file.

rcX.d services

/etc/rcX.d contains startup and shutdown scripts. (The startup scripts start with "S", the shutdown with "K". The standard recommendation is to rename the uppercase S to a lowercase one. However, Jeff Campione recommends renaming files with a prefix of "NO". My friend Jeff Veiss moves files into a subdirectory called "disabled".

The following table displays each of the Solaris Startup files, where they are placed, and which distribution and package they are part of. (I left out the "K" files for brevity. A list of resources which recommend which scripts can be disabled follows):

rc
directory

filename
installed with package package description MetaCluster comments
rcS.d S10cvc SUNWcvcr Network Console daemon and rc script SUNWCXall For E10000?
S10initpcmcia SUNWpcmci PCMCIA Card Services, (Root) SUNWCreq Initialize pcmcia cards
S15initpcihpc SUNWcsr Core Solaris, (Root) SUNWCreq ??
S30network.sh SUNWcsr Core Solaris, (Root) SUNWCreq start up networking; plumb each interface
S30rootusr.sh SUNWcsr Core Solaris, (Root) SUNWCreq does configuration needed to mount /usr via nfs
S33keymap.sh SUNWcsr Core Solaris, (Root) SUNWCreq loads keyboard mappings and initializes keyboard defaults
S35cacheos.sh SUNWcsr Core Solaris, (Root) SUNWCreq configure devices before setting up cache disk
S40standardmounts.sh SUNWcsr Core Solaris, (Root) SUNWCreq mount /usr, /usr/platform, etc
S41cachefs.root SUNWcsr Core Solaris, (Root) SUNWCreq if root is cachefs file system, startup cachefsd
S42coreadm SUNWcsr Core Solaris, (Root) SUNWCreq Restore the core file configuration that was in effect before reboot.
S42ncakmod SUNWncar Solaris Network and Cache Accelerator(Root) SUNWCall ??
S50devfsadm SUNWcsr Core Solaris, (Root) SUNWCreq configure /dev directory
S70buildmnttab.sh SUNWcsr Core Solaris, (Root) SUNWCreq mount file systems in mnttab
S01MOUNTFSYS SUNWcsr Core Solaris, (Root) SUNWCreq Mount all local filesystems
 
rc0.d? S01MOUNTFSYS        
rc1.d? S01MOUNTFSYS        
 




rc2.d
S01MOUNTFSYS SUNWcsr Core Solaris, (Root) SUNWCreq Mount all local filesystems
S05RMTMPFILES SUNWcsr Core Solaris, (Root) SUNWCreq remove files in /tmp and /var/tmp
S20sysetup SUNWcsr Core Solaris, (Root) SUNWCreq print the system configuration upon startup
S21perf SUNWaccr System Accounting, (Root) SUNWCall enable system activity data gathering
S30sysid.net SUNWadmr System & Network Administration Root SUNWCreq configures basic network functions
S40llc2 SUNWllcr LLC2 driver and its initialization programs SUNWCuser ??
S47asppp SUNWapppr PPP/IP Asynchronous PPP daemon configuration files SUNWCall start the PPP daemon
S69inet SUNWcsr Core Solaris, (Root) SUNWCreq configure ip routing, the default route;domain name
S70uucp SUNWbnur Networking UUCP Utilities SUNWCall clean up uucp lock files
S71ldap.client SUNWcsr Core Solaris, (Root) SUNWCreq starts ldap_cachemgr
S71rpc SUNWcsr Core Solaris, (Root) SUNWCreq start rpc
S71sysid.sys SUNWadmr System & Network Administration Root SUNWCreq if /.UNCONFIGURED exists reconfigure the system
S72autoinstall SUNWadmr System & Network Administration Root SUNWCreq if /.UNCONFIGURED exists reconfigure the system
S72inetsvc SUNWcsr Core Solaris, (Root) SUNWCreq start inetd
S72slpd SUNWslpr SLP, (Root) SUNWCuser ??
S73cachefs.daemon SUNWcsr Core Solaris, (Root) SUNWCreq starts up cachefs file systems
S73nfs.client SUNWcsr Core Solaris, (Root) SUNWCreq start lockd and statd;mount remote file systems
S74autofs SUNWatfsr System & Network Administration Root SUNWCreq start the automounter daemon
S74syslog SUNWcsr Core Solaris, (Root) SUNWCreq start the system logger daemon
S74xntpd SUNWntpr NTP, (Root) SUNWCuser startup network time protocol
S75cron SUNWcsr Core Solaris, (Root) SUNWCreq start cron daemon
S75flashprom SUNWuxflr Sun4u System FLASH PROM Update (?) SUNWCXall Install FLASH PROM Update for Sun4u Systems (?)
S75savecore SUNWcsr Core Solaris, (Root) SUNWCreq save core
S76nscd SUNWcsr Core Solaris, (Root) SUNWCreq start up the name service cache daemon
S80lp SUNWpsr SunSoft Print - LP Server, (root) SUNWCreq start the line printer scheduler
S80PRESERVE SUNWcsr save edit files in /usr/preserve SUNWCuser recovers data from unsaved vi sessions
S80spc SUNWpcr SunSoft Print - Client, (root) SUNWCuser something to do with printing
S85power SUNWpmr Power Management config file and rc script SUNWCuser power management
S88sendmail SUNWsndmr Sendmail root SUNWCreq start sendmail
S88utmpd SUNWcsr Core Solaris, (Root) SUNWCreq start up utmpd to clean up utmp entries
S89bdconfig SUNWdial Buttons/Dials Streams Module SUNWCall  
S90wbem SUNWwbcor WBEM Services (root) SUNWCuser ??
S91afbinit SUNWafbr Elite3D Device Drivers and Pipelines SUNWCXall For systems with Elite3D Graphics(?)
S91ifbinit SUNWifbr Sun Expert3D (IFB) Graphics System Software (Root) SUNWCXall For systems with Elite3D Graphics(?)
S92volmgt SUNWvolr   SUNWCuser start the volume management daemon
S93cacheos.finish SUNWcsr Core Solaris, (Root) SUNWCreq ??
S94ncalogd SUNWncar Solaris Network and Cache Accelerator(Root)? SUNWCall ??
S95ncad SUNWncar Solaris Network and Cache Accelerator(Root)? SUNWCall ??
S99audit SUNWcsr Core Solaris, (Root) SUNWCreq starts up auditd
S99dtlogin SUNWdtlog   SUNWCuser automatically start the CDE login window on the console
 




rc3.d
S15nfs.server SUNWcsr Core Solaris, (Root) SUNWCreq startup remote file sharing daemons
S50apache SUNWapchr Apache Web Server (root) SUNWCall startup http daemon
S76snmpdx SUNWsacom Solstice Enterprise Agents 1.0.3 files for root file system SUNWCuser startup snmp
S77dmi SUNWsacom Solstice Enterprise Agents 1.0.3 files for root file system SUNWCuser startup snmp
S80mipagent "SUNWmipmr(?)
or SUNWmipa"
Mobile IP mobility agent SUNWCall? x86 only?
 
rc?.d S10init1394 SUNW1394h IEEE 1394 Video Conferencing Support SUNWCxall? x86 Only?
rc?.d S95picld SUNWpiclr sunfire and sunblade SUNWCXall Needed for thermal diagnostics?

Notes:

Many of these scripts need to be disabled, some need to be modified, and a few need to be created.

Which ones can be disabled?
Unless you are absolutely sure, don't delete a startup file, just disable it. There is a difference between deleting a file and preventing them from starting up...

If sure are sure you don't need a file, then change its name or move it to a subdirectory called "disabled":


    mkdir /etc/rc1.d/disabled/
    mkdir /etc/rc2.d/disabled/
    mkdir /etc/rc3.d/disabled/
    mv -f /etc/rc2.d/S*asppp /etc/rc2.d/disabled/
There are many discussions on which startup files can be disabled (Sabernet, Roble, Jeff Campione/Sans , Sage, and others); and several scripts (Titan, YASSP-Post installation steps).

Which ones need to be modified?
Some of the existing rc files should be modified to add additional logging or increase security. For example, The line in /etc/rc2.d/S72inetsvc: /usr/sbin/inetd -s  should be modified to read /usr/sbin/inetd -s -t in order for inetd to trace the incoming connections. Syslog will now log the client's ip address and port number, along with the name of the service. You probably also should comment out the multicast route (224.0.0.0) located within this file.

Additional Startup Files
The experts recommend creating /etc/rc3.d/S70nddconfig  (and a link to /etc/init.d/nddconfig). This file will contain ndd commands designed to increase network security. (Solaris Operating Environment: Network Settings for Security). Jeff Campione also recommends creating an /etc/rc2.d/S75sshd  startup script. If you have any static routes or proxy arp entries, create a file /etc/rc2.d/S99static_routes  and place the arp and "route" commands in it. (Source: YASSP-Post installation steps))

Titan also creates a /etc/rc3.d/S79tmpfix (/etc/init.d/tmpfix) to change the "sticky bit" on the /tmp directory.


Recommended Links

Softpanorama Top Visited

Softpanorama Recommended


http://www.securityfocus.com/focus/sun/articles/install.html- Securityfocus

http://www.roble.com/docs/secure_solaris.html- Roble

http://www.ist.uwaterloo.ca/security/howto/2000-09-19.html - Univ of Waterloo (good discussion of services, also a script to shut them off)

http://www.usenix.org/sage/sysadmins/solaris/solaris/services.html#startups- Sage

http://www.sabernet.net/papers/Solaris.html- Sabernet

http://www.fish.com/titan- Titan

http://www.sans.org/y2k/practical/Jeff_Campione_GCUX.htm- Jeff Campione/Sans

http://www.sun.com/blueprints/1200/network-updt1.pdf,
http://www.sun.com/solutions/blueprints/1299/network.pdf - Solaris Operating Environment: Network Settings for Security

http://www.yassp.org/after.html- YASSP: Post installation steps





MGMG Articles:
(C)Copyright 2002 David Glosser
mgmg_interactive12345@hotmail.com (remove all numbers from email address).
Please read disclaimer.
Back to Index


Etc

Society

Groupthink : Understanding Micromanagers and Control Freaks : Toxic Managers : BureaucraciesHarvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Two Party System as Polyarchy : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

Skeptical Finance : John Kenneth Galbraith : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes : Oscar Wilde : Talleyrand : Somerset Maugham : War and Peace : Marcus Aurelius : Eric Hoffer : Kurt Vonnegut : Otto Von Bismarck : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce : Oscar Wilde : Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 26, No.1 (January, 2013) Object-Oriented Cult : Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks: The efficient markets hypothesis : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Vol 23, No.10 (October, 2011) An observation about corporate security departments : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Haterís Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

 

The Last but not Least


Copyright © 1996-2014 by Dr. Nikolai Bezroukov. www.softpanorama.org was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Site uses AdSense so you need to be aware of Google privacy policy. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine. This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to make a contribution, supporting hosting of this site with different providers to distribute and speed up access. Currently there are two functional mirrors: softpanorama.info (the fastest) and softpanorama.net.

Disclaimer:

The statements, views and opinions presented on this web page are those of the author and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

Last modified: March 28, 2014