Solaris Security: Additional Solaris Packages you should add to increase System Security

Solaris Security: Additional Packages

Optional Solaris Packages:

The following packages can enhance the security of your system by increasing logging, auditing, or can increase your functionality.

Source	Package	Description	Comment
Sage	SUNWlibCf	SPARCompilers Bundled libC Cfront version	For showrev support
	SUNWadmc	System administration core libraries
	SUNWadmfw	System & Network Administration Framework
	SUNWadmj	Admin/Install Java Extension Libraries
	SUNWter	Terminal Information Terminal emulation support

Spitzner (old)	SUNWadmc	System administration core libraries
	SUNWadmfw	System & Network Administration Framework
	SUNWdoc	Documentation Tools
	SUNWman	On-Line Manual Pages
	SUNWgzip	The GNU Zip (gzip) compression utility

Spitzner-new	SUNWbash	GNU Bourne-Again shell (bash)
	SUNWbzip	The bzip compression utility	Compression Utilities
	SUNWbzipx	The bzip compression library (64-bit)
	SUNWgzip	The GNU Zip (gzip) compression utility
	SUNWzip	The Info-Zip (zip) compression utility
	SUNWdoc	Documentation Tools	Man Pages
	SUNWman	On-Line Manual Pages
	SUNWntpu	NTP, (Usr)	NTP Support
	SUNWntpr	NTP, (Root)
	SUNWtoo	Programming Tools	Truss and other troubleshooting tools.
	SUNWtoox	Programming Tools (64-bit)
	SUNWfns	Federated Naming System	Snoop sniffing utility
	SUNWfnsx	Federated Naming System (64-bit)
	SUNWxcu4	XCU4 Utilities	For Secure Shell X Tunneling
	SUNWxcu4x	XCU4 Utilities (64-bit)
	SUNWxwplt	X Window System platform software
	SUNWxwplx	X Window System library software (64-bit)
	SUNWxwrtl	X Window System & Graphics Runtime Library Links in /usr/lib
	SUNWxwrtx	X Window System Runtime Compatibility Package (64-bit)

Solaris Minimization:	SUNWntpr	NTP, (Root)
Solaris Minimization:	SUNWntpu	NTP, (Usr)

Other Packages	SUNWaccr	System Accounting, (Root)	System and Process Accounting
	SUNWaccu	System Accounting, (Usr)
	SUNWast	Automated Security Enhancement Tools	ASET will provide security reports &optionally fix them.

Application-Specific Package Dependencies

There will be additional application-dependent packages you will need to install. For example, SUNWlibC, SUNWter, and SUNWscpu are required for fw1 (Source: Spitzner).Ip filter will require SUNWhea, SUNWsrh, SUNWbtool, SUNWscpu, SUNWtoo, SUNWlibm, SUNWsprot, and SUNWarc (Source: Unix Circle).

Startup Files

Many of the packages you left on the system install services which you may not need. For example, SUNWcsr installs scripts which start up services such as cachefs and NFS. If you do not need these services, you should disable these startup files. If you are unsure what each startup service does, read our article. can be disabled, read our latest article. Other discussions of startup files include: Securityfocus, roble, Univ of Waterloo (which has a good discussion of services, also a script to shut them off), Sage, sabernet, or study one of the hardening programs, such as Titan or YASSP's post installation steps.
.

References

Spitzner: http://www.enteract.com/~lspitz/core8.txt, http://www.enteract.com/~lspitz/armoring2.html

Security Focus: http://www.securityfocus.com/focus/sun/articles/install.html

Solaris Minimization: http://www.sun.com/software/solutions/blueprints/1100/minimize-updt1.pdf

Roble: http://www.roble.com/docs/secure_solaris.html

Sage: http://www.usenix.org/sage/sysadmins/solaris/solaris/os.html#minimal

Unix Circle: http://www.unixcircle.com/features/BuildingSolarisFW.php

Univ of Waterloo: http://www.ist.uwaterloo.ca/security/howto/2000-09-19.html

Sabernet: http://www.sabernet.net/papers/Solaris.html

Titan: http://www.fish.com/titan.
Back to Index

MGMG Articles:

http://www.mgmg-interactive.com/
Solaris, Cisco, Firewall, Security Resources
http://www.mgmg-interactive.com/packages1.html
An introduction to Solaris OS Installation options: Solaris Packages, Clusters, Software Groups
http://www.mgmg-interactive.com/packages2.html
A meta-analysis of the extra Solaris packages that several experts suggest you should install (not part of Core Install)
http://www.mgmg-interactive.com/packages3.html
An examination the packages installed with the Solaris SUNWCreq "core" installation, and a meta-analysis of which packages the experts suggest you remove as part of the minimalization process in order to enhance system security.
http://www.mgmg-interactive.com/solaris_startup_files.html
An analysis of Solaris 8 startup files: Even if you performed a minimal Solaris install, there are a bunch of startup files which need to be disabled as part of your hardening routine. This paper lists each Solaris startup file along with its associated package, as well as checklists and scripts to delete (and modify/add) startup files designed to increase system security.
http://www.mgmg-interactive.com/malware.html
This paper describes the role that Browser Helper Objects (BHOs) play in adware infections and briefly outlines corporate anti-adware options. It also announces a new free network bho scanner, which scans a corporate network for spyware infections by scanning remote registries for the presence of unauthorized Browser Helper Objects (BHOs).

(C)Copyright 2002-2005 David Glosser
mgmg_interactive12345@hotmail.com (remove all numbers from email address).
Please read disclaimer.

Back to Index