Solaris

Hardening Solaris Systems in Production When you’re running enterprise workloads on Solaris — databases, application servers, web fronts — the gap between “it works” and “it’s secure” is a lot wider than most people expect. I spent a good chunk of time working through hardening procedures for a fleet of Solaris boxes, and what follows is the procedure we landed on. The scope covered four server types: database, web, application, and utility. Every one of them got the same four security layers, regardless of role. ...

Managing services on Solaris 10 is nothing like Linux. There are no /etc/init.d/ scripts, no service command, no chkconfig. Instead, Solaris uses SMF — the Service Management Facility — and everything goes through svcadm. If you are new to Solaris, this can feel unnecessarily complicated. It is not, once you learn the pattern. Disabling a service You need root privileges or sudo access. The command is: svcadm disable network/cswpuppetd:default The argument is the service FMRI (Fault Management Resource Identifier). For Puppet installed from OpenCSW, the FMRI is network/cswpuppetd:default. The :default part refers to the default instance of the service. Some services have multiple instances, but most only have one. ...

Puppet on Solaris 10 stores its logs in the SMF log directory, which is different from the /var/log location you might be used to on Linux. If you are looking for the usual log files and cannot find them, this is probably why. Agent logs The Puppet agent (puppetd) runs as an SMF service, and its log is at: /var/svc/log/network-cswpuppetd:default.log To watch it in real time: tail -f /var/svc/log/network-cswpuppetd:default.log Master logs The Puppet master (puppetmasterd) follows the same pattern: ...