Solaris Minimalization and Security:
Packages, Clusters, Software Groups

SUNWreq install

The following is a summary of different packages installed during my Netra T1 North American SUNWreq installation, and whether or not some of the "experts" believe it could be removed to as part of a minimalization process to harden the system and improve system security. If there is a 64-bit version of a core package, then I've also included it here even though they are at present not part of the SUNWreq metacluster I installed. (I performed the install before the latest Solaris 8 distribution, which installs 64-bit packages.) For my own sanity, I devided it up into packages installed that are part of the SUNWreq metacluster, Localization packages,and OEM packages and clusters

As you expect, there is no consensus as to which packages should be removed as part of the Solaris lockdown process. If a cell is empty, it is because the author did not explicitly mention whether or not to keep or remove the package. Remember, the authors did not all use the same hardware platform and OS version. Each system is different, so your individual results may vary, especially in regards to the OEM packages. (For example, Lance Spitzner's included a bunch of fibre-channel packages which were not part of my install, such as SUNWfcip, SUNWfctl, etc.)

These packages are in the actual SUNWreq metacluster:

Locale Packages
(According to the.clustertoc file, the following packages do not belong to any metacluster, but they seem to get installed as part of a locale support. I performed a typical US/North American English install)

Platform-specific (OEM)
The following packages were also installed as part of my "Core" install of a Netra T1, are listed as part of the "SUNWCXall" metacluster

Application-Specific Package Dependencies

Removing Packages

# pkgrm SUNWpcelx SUNWpcmci SUNWpcmcu SUNWpcmem SUNWpcser SUNWpsdpr

Startup Files

References

• http://www.mgmg-interactive.com/
  Solaris, Cisco, Firewall, Security Resources
  
• http://www.mgmg-interactive.com/packages1.html
  An introduction to Solaris OS Installation options: Solaris Packages, Clusters, Software Groups
  
• http://www.mgmg-interactive.com/packages2.html
  A meta-analysis of the extra Solaris packages that several experts suggest you should install (not part of Core Install)
• http://www.mgmg-interactive.com/packages3.html
  An examination the packages installed with the Solaris SUNWCreq "core" installation, and a meta-analysis of which packages the experts suggest you remove as part of the minimalization process in order to enhance system security.
• http://www.mgmg-interactive.com/solaris_startup_files.html
  An analysis of Solaris 8 startup files: Even if you performed a minimal Solaris install, there are a bunch of startup files which need to be disabled as part of your hardening routine. This paper lists each Solaris startup file along with its associated package, as well as checklists and scripts to delete (and modify/add) startup files designed to increase system security.
• http://www.mgmg-interactive.com/malware.html
  This new article on Centralized Spyware Detection briefly describes how spyware and adware use Browser Helper Objects (BHOs) to hijack Internet Explorer. It also announces a remote spyware detector which detects spyware infections on a corporate network by scanning remote registries for the presence of unauthorized Browser Helper Objects (BHOs).

  ---