KarkomaOnline

This post outlines some of the post-installation tasks I usually perform after a fresh Solaris 10 installation. Note that this is my own approach and that it is based on x86 archictecture.

The first general tasks involve linuxifying the new environment and setting some environment variables:

a) Changing root account settings:

vi /etc/passwd
root:x:0:0:Super-User:/root:/usr/bin/bash

b) Creating a directory for the root account:

mkdir /root
mv /.bash* /root
mv /.sunw /root

c) Modifying /etc/profile or /root/.bash_profile according to my preferences:

PS1=’[33[01;31m]SERVER-NAME [33[00m]u@h:[33[01;34m]w[33[00m]$ ‘

alias la=”ls -alh”
alias cp=”cp -i”
alias mv=”mv -i”
alias rm=”rm -i”

PATH=/opt/csw/bin:/usr/sbin:/usr/bin:/usr/openwin/bin:/usr/dt/bin:/usr/ccs/bin:$PATH
export PATH

export TERM=xterm

d) Network stuff:

vi /etc/resolv.conf

search mydomain.com
nameserver 192.168.1.2

vi /etc/defaultrouter

192.168.1.1

cd /etc
cp nsswitch.dns nsswitch.conf

e) Once finished this basic configuration, I usually install and configure PKG-GET for the package management:

mkdir /tmp/karkoma

cd /tmp/karkoma

/usr/sfw/bin/wget http://www.blastwave.org/pkg_get.pkg
pkgadd -d pkg_get.pkg all

/usr/sfw/bin/wget http://www.blastwave.org/wget-i386.bin
chmod 755 wget-i386.bin

PATH=/tmp/karkoma:/opt/csw/bin:/usr/sbin:/usr/bin:/usr/dt/bin:/usr/openwin/bin:/usr/ccs/bin
export PATH

vi /opt/csw/etc/pkg-get.conf

Change this file according to your needs, remember to pick a mirror nearest to you. Then continue with the following:

pkg-get -i wget

PATH=/opt/csw/bin:/usr/sbin:/usr/bin:/usr/openwin/bin:/usr/dt/bin:/usr/ccs/bin
export PATH

pkg-get -i gnupg

Note that by adding the PATH to /etc/profile it will be available system wide.

f) Add users to your new environment:

mkdir -p /export/home
useradd -d /export/home/username -m -s /bin/bash -c “Franz Kafka” username
passwd username

g) Finally disable un-needed services

svcadm disable sendmail
svcadm disable ftp
svcadm disable telnet
svcadm disable finger

That’s all. Now, what kind of tasks do you perform in a fresh installation?

References:

• From KarkomaOnline.

According to Sun, the new Solaris 10 5/08 release will be available on April 14, 2008. This new release includes a lot of improvements and new features. Take a look into what’s new.

Solaris OS provides the /etc/release file to easily determine the base OS level or the OS release.

cat /etc/release

Solaris 10 8/07 s10x_u4wos_12b X86
Copyright 2007 Sun Microsystems, Inc. All Rights Reserved.
Use is subject to license terms.
Assembled 16 August 2007

Xnest is a nested X server that I use in some cases to remotely access my Solaris 10 boxes. From Xnest man pages:

Xnest is a client and a server. Xnest is a client of the real server which manages windows and graphics requests on its behalf. Xnest is a server to its own clients. Xnest manages windows and graphics requests on their behalf. To these clients Xnest appears to be a conventional server.

I’ve installed X11 on my MacBook and now I can log into my server:

Xnest -query solaris_host01 :2 &

If you get an error like this:

Not on system console, root login rejected

Edit /etc/default/login and comment out the following line.

# CONSOLE=/dev/console

Be very carefull with this for the security implications. That’s all.

The next link will show you a set of wonderful features of the OpenSolaris and Solaris operating systems. This has been written by the Open Solaris Community: OpenSolaris Primer. Many thanks to them.

One of the security enhancements that Solaris 10 provides is the ability to restrict the output of the ps command so that users can only see processes that they own.

So to globally control if users are able to watch processes belonging to other users edit the /etc/security/policy.conf file and add the following entry:

PRIV_DEFAULT=basic,!proc_info

Now users will only be able to see processes that they own. Note however, that this obviously will not affect the root user.

If you are interested in Solaris privileges, you’ll find a good intro from Casper Dik’s Weblog.