solaris 10 安全设置初步

用ssh登陆后用以下步骤即可关掉以下进程和服务

 

a chmod +w /etc/inetd.conf;   vi /etc/inetd.conf
   在行前插入#已关闭对应的服务,如下
   #100235/1 tli rpc/ticotsord wait root /usr/lib/fs/cachefs/cachefsd cachefsd"
   #100083/1 tli rpc/tcp wait root /usr/dt/bin/rpc.ttdbserverd   rpc.ttdbserverd
   #100068/2-5 dgram rpc/udp wait root /usr/dt/bin/rpc.cmsd  rpc.cmsd

 

b  关闭不用的服务和进程

svcadm disable svc:/network/rpc/gss:default
svcadm disable svc:/network/rpc/rstat:default
svcadm disable svc:/network/rpc/cde-calendar-manager:default
svcadm disable svc:/network/rpc/cde-ttdbserver:tcp
svcadm disable svc:/network/rpc/smserver:default
svcadm disable svc:/network/rpc/rusers:default
svcadm disable svc:/network/rpc/bootparams:default 
svcadm enable  svc:/network/rpc/bind:default
svcadm disable svc:/network/nfs/status:default
svcadm disable svc:/network/nfs/cbd:default
svcadm disable svc:/network/nfs/mapid:default
svcadm disable svc:/network/nfs/nlockmgr:default
svcadm disable svc:/network/nfs/client:default
svcadm disable svc:/network/nfs/rquota:default
svcadm enable  svc:/network/inetd:default
svcadm disable svc:/application/management/dmi:default
svcadm disable svc:/application/management/sma
svcadm disable svc:/application/management/seaport
svcadm disable svc:/application/management/snmpdx:default
svcadm disable svc:/network/rpc-100235_1/rpc_ticotsord:default 
svcadm disable svc:/application/cde-printinfo:default
svcadm disable svc:/application/graphical-login/cde-login:default

svcadm disable svc:/network/cde-spc:default
svcadm disable finger ftp telnet finger rlogin sendmail autofs:default
svcadm disable shell:default shell:kshell webconsole rfc1179

 

c 编辑/etc/snmp/conf/snmpd.conf

   在read-community  public行后加入6个任意字符

   在system-group-read-community后加入6个任意字符

   编辑/etc/resolv.conf 加入dns server

   nameserver 61.139.2.69
   nameserver 221.236.9.9
   nameserver 210.77.146.30

   编辑/etc/defaultrouter加入你的网关IP

   编辑/etc/nsswitch.dns将hosts行改成 hosts:      files dns

   用sun update manager给系统打补丁给OS打补丁或者用sun的dvd

   iso(7G)安装:

1) Mount the patch iso:
   lofiadm -a /w/2/sou/eis-dvd-v2k712.iso /dev/lofi/2
   mount -F hsfs -o ro /dev/lofi/2 /w/2/sou/iso2
2) cd /w/2/sou/iso2/sun/install
3) . ./profile-EIS
4) ./setup-standard.sh
5) cd /w/2/sou/iso2/sun/patch/10
6) goto the desired directory where the patches are available
7) /opt/sun/bin/unpack_patches /var/tmp  #provide the path for unpacking for ex : /var/tmp
8) init S
9) cd /var/tmp
10) ./install_all_patches

设置环境PATH:

PATH=/sbin:/usr/bin:/usr/sbin:/opt/sun/bin:/opt/csw/bin:/opt/csw/sbin:/usr/sfw/bin:/usr/sfw/sbin:/usr/dt/bin:/usr/openwin/bin:/usr/ccs/bin
设置允许root登入：
vi /etc/ssh/sshd_config
PermitRootLogin yes
svcadm restart ssh

e  配置防火墙（针对dns服务器而言）

  1. 生成conf  vi /etc/ipf/ipf.conf
#icmp ok
pass in log quick proto icmp from any to any
pass out log quick proto icmp from any to any

#dns ok
pass in log quick proto udp from any to any port = 53 keep state
pass out log quick proto udp from any port = 53 to any keep state #service
pass out log quick proto udp from any to any port = 53 keep state #digui query

#ssh ok
pass in log quick proto tcp from any to any port = 22 keep state
#vnc port range 5900-5904 ok
pass in log quick proto tcp from any to any port 5900 >< 5905 keep state

#block
block in log quick proto tcp from any to any
block in log quick proto udp from any to any
block out log quick proto tcp from any to any
block out log quick proto udp from any to any

  2. vi  /etc/ipf/pfil.ap
把你的网卡相同的名前取消#使之生效。
hme     -1      0       pfil

  3. svcadm enable svc:/network/pfil:default
     svcadm enable svc:/network/ipfilter:default

f 重起reboot