Solaris 9 General Security Settings

1. select an appropriate installation.

Only install the required software package.
This example is solaris9.

2. Install System Patches

Download the patch from sunsolve.sun.com
Unzip 9_Recommended.zip
Cd 9_Recommended
./Install_cluster

3. Minimize Service Startup

A. Disable services that do not need to be started. Generally, the service can be disabled.

A.1 S01MOUNTFSYS
Mount all local filesystems.
A.2 S05RMTMPFILES
Start to delete temporary files
A.3 S20sysetup
System settings need to be started
A.4 S21perf
All are commented out ......
A.5 S30sysid.net
Network settings need to be started
A.6 S40llc2
LLC2 protocol support needs to be started
A.7 S42ncakmod
Ncakmod is used to start or stop the SolarisNetworkCache
And Accelerator ("NCA") kernel module needs to be started
A.8 S47pppd
Ppp support does not need to be started
Run: mv S47pppd _ S47pppd
A.9 S69inet
TCP/IP configuration needs to be started
A.10S70sckm
Sun fire 15000Key Management Daemon does not need to be started
Run: mv S70sckm _ S70sckm
A.11 S70uucp
Unix-to-Unix Copy is not required
Mv S70uucp _ S70uucp
A.12 S71ldap. client
-You do not need to start the LDAP client.
Mv S71ldap. client _ S71ldap. client
A.13S71rpc
S71rpc + start rpcbind service rpcbind (RPC Portmap service). If CDE is required, this process must be started.
A.14 S71sysid. sys
To configure system parameters, you must
A.15 S72autoinstall
The installation script is automatically started when sun-compatible media is put.
Mv S72autoinstall _ S72autoinstall
A.16 S72directory
Directory Service is not required
Mv S72directory _ S72directory
A.17 S72inetsvc
Start inet server, including named/nis. If named and nis services are not required, disable
Mv S72inetsvc _ S72inetsvc
A.18 S72slpd
Print Service not required
Mv S72slpd _ S72slpd
Print Service

A.19 S73cachefs. daemon
NFS cache service, which can improve NFS Throughput
Mv S73cachefs. daemon _ S73cachefs. daemon
A.20 S73mpsadm
Cluster service management process? No
Mv S73mpsadm _ S73mpsadm
A.21 S73nfs. client
Nfs client is not required
Mv S73nfs. client _ S73nfs. client
A.22 S74autofs
When NFS is used, this process automatically loads or detaches useless user network file systems.
Configuration files/etc/auto_home and auto_master
However, when nfs is not used, this process will have some negative impact on system management and does not need
Mv S74autofs _ S74autofs
A.23 S74syslog
System log service process requirements
A.24 S74xntpd
Network Time Synchronization Service is not required
Mv S74xntpd _ S74xntpd
A.25 S75cron
Automatic script execution is required
A.26 S75flashprom
It looks like a flash update script
A.27 S75savecore
Core Memory Dump script required
A.28 S76nscd
DNS name cache service is not required
Mv S76nscd _ S76nscd
A.29 S77sf880dr
A script for V880 machines is not required
MvS77sf880dr _ S77sf880dr
A.30 S80lp
Print Service not required
Mv S80lp _ S80lp
A.31 S80spc
Or print service is not required
MvS80spc _ S80spc
A.32 S85power
Power Management Needs
A.33 S88sendmail
Email service is not required
Mv S88sendmail _ S88sendmail
A.34 S88utmpd
Theutmpd daemonmonitorsthe/var/adm/utmpxfile
It is related to account information control. The Daemon monitors the/etc/utmp file within the time interval of the rule to obtain the validity of user process items. Based on the progress table
The process ID of this item is used to remove the terminated but not cleared user processes in the/etc/utmp file. Yes
A.35S89PRESERVE
Alibaba Cloud needs
A.36 S90loc.ja.css d
After reading the script, I don't know why CS needs it.
A.37 S90wbem
WBEM, Solaris system management interface server, which can be/usr/sadm/bin/smc
No need to start client program connection management
Mv S90wbem _ S90wbem
A.38 S91afbinit S91gfbinit S91ifbinit S91jfbinit
For systems with Elite3D Graphics, there is no need For a Graphics card.
Mv S91afbinit _ S91afbinit
Mv S91gfbinit _ S91gfbinit
Mv S91ifbinit _ S91ifbinit
Mv S91jfbinit _ S91jfbinit
A.39 S91zuluinit
Find out how many zulu cards are installed on the system is not required
Mv S91zuluinit _ S91zuluinit

A.40 S93cacheos. finish
Cache file system not required
Mv S93cacheos. finish _ S93cacheos. finish
A.41 S94Wnn6
The Japanese input system is not required.
Mv S94Wnn6 _ S94Wnn6
A.42 S94ncalogd
NCA process logs are not required
Mv S94ncalogd _ S94ncalogd
A.43 S95IIim
Start the input method daemon Solaris international support part, start the East Asian language input method needs
A.44 S95svm. sync
Devfsadm, devfs synchronization process monitoring system hardware, make/dev and/devices device file synchronization needs
A.45 S98efcode
Embedded FCode interpreter daemon, efdaemon is used on selected platforms as part of the processing of some
Dynamic reconfiguration events does not know why, so he has to run
A.46 S99atsv
It may be in Japanese and not installed on the machine.
A.47S99audit
Audit process needs
A.48S99dtlogin
Start the CDE logon process Solaris CDE graphical interface to start the process
A.49 S99rcapd
Requirements related to resource recovery

Under rc3.d
A.50 S13kdc. master S14kdc
Kdc service is not required
Mv S13kdc. master_S13kdc.master
Mv S14kdc_S14kdc
A.51 S15nfs. server
Nfs service is not required
Mv S15nfs. server _ S15nfs. server
A.52 S16boot. server
No need to remotely start the service
Mv S16boot. server _ S16boot. server
A.53S34dhcp
Dhcp service is not required
Mv S34dhcp _ S34dhcp
A.54 S50apache
Http service is not required
Mv S50apache _ S50apache
A.55 S50san_driverchk
San Driver Check? Not installed on the machine
Mv S50san_driverchk _ S50san_driverchk
A.56 S76snmpdx
No need to start the snmp service
Mv S76snmpdx _ S76snmpdx
A.57 S77dmi
Snmp sub-services are not required
Mv S77dmi _ S77dmi
A.58 S80mipagent
Do not need to start Mobile IP proxy
Mv S80mipagent _ S80mipagent
A.59S81volmgt
Volume management needs for a floppy drive
A.60S84appserv
Sun one server is not required
Mv S84appserv _ S84appserv
A.61 s0000shd
Yes
A.62 S90samba
You need to mount a windows file system.
Mv S90samba _ S90samba
A.63 S86directorysnmp
Not Required for Sun Directory Service
Mv S86directorysnmp _ S86directorysnmp
A.64 S99JESsplash