A usable Solaris server without X or other cruft

The last post was left in a somewhat unfinished state – a description of which software to select at install time to get a usable server installed without X was left out. The following works for me – some things could be left out, and some things could certainly be added, but my strategy is to put as little as possible in the global zone of a server, then do all the heavy lifting in the confines of a zone or container.

The version of OpenSolaris used was Solaris Express Community Edition build 66, however it has been used successfully with several builds from 54 to 66.

Once you get to the “Select Software” page in the installer, select “Core System Support”, then press F4 to customise the selection. Then go like this:

• deselect Audio drivers and applications
• add the BIND DNS name server, tools and manifest. This gives you handy tools like host, dig, and nslookup if that’s your thing
• add Documentation Tools
• remove FTP server, usr and root
• add the Fair Share Scheduler. I have yet to use this but it looks good for servers with multiple workloads (read: zones)
• add Infozip from the freeware compression utilities
• add patch and less from freeware other utilites. Reading man pages with more is something you get tired of very quickly
• add bash from freeware shells
• add GNU and open source documentation and man pages
• from GNU binutils, C compiler add GCC runtime libraries
• add GNU wget
• add Lint libraries (usr)
• add Live Upgrade software
• remove Network File System server support
• remove Network Information System/(root) – leave (usr)
• add Online manual pages
• add all of OpenSSL
• add the Perl 5.8.4 reference manual pages. These actually contain files that CPAN uses for “make test” for some modules; took me a while to track that one down
• add Programming tools and everything in Programming tools and libraries
• remove everything in Remote network services and commands except the telnet client. As a brief aside, it is remarkable that Sun would leave this bunch of legacy crap in as default, but leave out SSH
• add Secure Shell
• remove Solaris desktop /usr/dt filesystem anchor. I have no idea what this does; omitting it doesn’t seem to hurt
• add Solaris resource capping daemon. This is to limit the amount of memory a zone can allocate for itself
• add everything from Solaris Zones
• add SunOS header files
• add everything from System Accounting
• add everything from System and Network admin. In order to do this, expand the list and add each subitem individually. If you don’t do this, they get deselected silently at the end; I have no idea why, and it looks like a bug
• add TCL
• add Terminal information
• remove Wireless drivers and config tools
• remove X window system runtime environment
• add core software for resource pools. This may be of use when binding processor cores to zones
• add gcmn, ggrep, gtar and rsync
  

If you press F2 now you will probably get some dependency warnings – anything about X, audio drivers and Java can generally be ignored.

It seems a lot of effort to go to, but at the end you have a usable, cruft-free starting point on which to build zones, software etc. Quite a few of the above packages are there purely to support a compiler toolchain – if this isn’t needed some pruning could be done.

Quick update - the programming tools and Lint libraries packages seem to be silently dropped as well - I needed to add them in from the disk image afterwards:

mkdir /mnt/66
mount -F hsfs -o ro `lofiadm -a \
/root/sol-nv-b66-x86-dvd.iso` /mnt/66
pkgadd -d /mnt/66/Solaris_11/Product/ SUNWbtool SUNWsprot SUNWlibmr SUNWlibm

Solaris installer grumbles

There are a number of ways in which the Solaris Express installation program could be improved. Off the top of my head:

1) There is no appropriate option on the "Select Software" page for a server system without X. The Entire, Developer and End User groups give you far too much (do you really want StarOffice on your server?); the Core and Reduced Networking groups give you too little (you don't get SSH, but you do get, er, telnet).

2) No firewall configured or enabled

3) Passwords are hashed with DES, including the root password - this limits the maximum password length to 8

4) Root's home directory is /

My way around this is to select "Manual" when the installer asks me if I want the system to reboot automatically at the end, then exit to a shell when prompted. The new system's root partition is mounted on /a, so we can make some of the changes now:

# mkdir /a/root
# chmod 700 /a/root

Now use vi to edit /a/etc/passwd so that root's home directory is /root and shell is /usr/bin/bash (assuming you selected bash to be installed earlier in the installation).
Edit /a/etc/security/policy.conf so that CRYPT_ALGORITHMS_ALLOW is commented out, CRYPT_ALGORITHMS_DEPRECATE=unix is uncommented and CRYPT_DEFAULT=md5.

Now type init 6 to reboot. Once you have logged back in as root, reset your password using passwd - you now can use more than 8 chars.

To enable a basic firewall, add the following to the /etc/ipf/ipf.conf file (change bge0 to the name of your network interface, and 192.168.20.1 to its IP address):

## Block malformed packets
block in log quick all with short
block in log quick all with ipopts
## Anything on loop back is fine
pass in quick on lo0 all
pass out quick on lo0 all
## Default block
block in on bge0 all
block out on bge0 all
## Allow pings out
pass out quick on bge0 proto icmp all keep state
## Allow any UDP/TCP packets out
pass out quick on bge0 proto tcp/udp from any to any keep state
## SSH in
pass in log quick on bge0 proto tcp from any to 192.168.20.1/32 port = 22 keep state

Now type svcadm enable ipfilter to enable the filter.

I have a recipe for a server install which gives you all you need to run a production system without X, but as it is somewhat lengthy I think I'll leave that for another post.