AIX install

Steps used for customizing an AIX 6.1 install image.

WARNING: It requires further refinement. Some steps may be different or unnecessary in other environments.

Settings used for install:

JFS2/64bit as default on 6.1
Install graphics software (X11)
Don't install system management software (pconsole)
Install all drivers
Don't use Trusted AIX

System

General

Expand maximum user name length

chdev -l sys0 -a max_logname=64

Enable online disk statistics

chdev -l sys0 -a iostat=true

Enable full system core dumps

chdev -l sys0 -a fullcore=true

Set a strong password algorithm instead of crypt()

chsec -f /etc/security/login.cfg -s usw -a pwd_algorithm=ssha1

Change timezone to CEST (Hungary)

chtz CET-1CEST,M3.5.0,M10.5.0

Install custom crontab for root

crontab /tmp/install/config/crontab.txt

Generate man whatis database

catman -w

Network services, inittab

Disable sendmail, inetd

chrctcp -Sd sendmail

chrctcp -Sd inetd

Install custom ntp.conf

cp /tmp/install/config/ntp.conf /etc/

touch /etc/ntp.drift /etc/ntp.trace

Enable xntpd

chrctcp -Sa xntpd

Install custom syslog.conf

cp /tmp/install/config/syslog.conf /etc/

Syslogd still cannot create logfiles...

touch /var/adm/ras/syslog

Reload syslogd

refresh -s syslogd

Save inittab

cp /etc/inittab /etc/inittab.DEFAULT

Disable a lot of stuff from inittab

chitab "mkatmpvc:2:off:/usr/sbin/mkatmpvc >/dev/console 2>&1"

chitab "atmsvcd:2:off:/usr/sbin/atmsvcd >/dev/console 2>&1"

chitab "sniinst:2:off:/var/adm/sni/sniprei > /dev/console 2>&1"

chitab "piobe:2:off:/usr/lib/lpd/pioinit_cp >/dev/null 2>&1 # pb cleanup"

chitab "qdaemon:off:/usr/bin/startsrc -sqdaemon"

chitab "writesrv:off:/usr/bin/startsrc -swritesrv"

chitab "uprintfd:off:/usr/sbin/uprintfd"

chitab "naudio2::off:/usr/sbin/naudio2 > /dev/null"

chitab "naudio::off:/usr/sbin/naudio > /dev/null"

chitab "ntbl_reset:2:off:/usr/bin/ntbl_reset_datafiles"

chitab "rcwpars:2:off:/etc/rc.wpars > /dev/console 2>&1 # Corrals autostart"

chitab "xmdaily:2:off:/usr/bin/topasrec -L -s 300 -R 1 -r 6 -o /etc/perf/daily/ -ypersistent=1 2>&1 >/dev/null #Start local binary recording"

chitab "ha_star:h2:off:/etc/rc.ha_star >/dev/console 2>&1"

Reload init

telinit q

Filesystems, dump

Disable livedump and remove filesystem

dumpctrl -P ldmpoff

bosboot -a

umount /var/adm/ras/livedump

rmfs /var/adm/ras/livedump

Remove default unused /admin filesystem

umount /admin

rmfs /admin

System configuration files

Remove failedlogin file from /

rm -f /etc/security/failedlogin

touch /var/adm/ras/failedlogin

ln -sf /var/adm/ras/failedlogin /etc/security/failedlogin

Install custom sudoers -- TODO: migrate to sudo with LDAP support

cp /tmp/install/config/sudoers /etc/

Install custom hosts and resolv.conf

cat /tmp/install/config/hosts.add >> /etc/hosts

cp /tmp/install/config/resolv.conf /etc/

Configure IPv4 name resolution in /etc/netsvc.conf

hosts = local4, bind4

Users

Separate root home

mkdir /root

chmod 700 /root

chown root:system /root

chuser home=/root fsize=-1 root # set file size to unlimited for root

Profiles, environment files, user skeleton

cp /tmp/install/profile/* /root/

cp /tmp/install/config/.ids /etc/security/.ids

cp /tmp/install/config/mkuser.sys /etc/security/mkuser.sys

cp /tmp/install/profile/* /etc/security/

Remove unnecessary 'guest' user

rmuser guest

Function to extend valid shells with bash

add_bash="echo $(lssec -f /etc/security/login.cfg -s usw -a shells | awk -F\= '{print $2}'),/usr/bin/bash"

  if [ $(grep -c bash /etc/security/login.cfg) = 0 ]; then

    cp /etc/security/login.cfg /etc/security/login.cfg.DEFAULT

    chsec -f /etc/security/login.cfg -s usw -a shells=$add_bash

fi

Check which users have a valid shell and remote (network) login enabled and disable (some of) them:

# lsuser -a rlogin shell ALL | grep true

daemon rlogin=true

bin rlogin=true

sys rlogin=true

adm rlogin=true

nobody rlogin=true

lpd rlogin=true

user1 rlogin=true shell=/usr/bin/bash

user2 rlogin=true shell=/usr/bin/ksh

By default, the following default system users have a shell and rlogin enabled, but these have no password set: lp invscout ipsec nuucp

Root rlogin can be disabled... although sshd_config would restrict root login anyway.

Kernel tunables

Network parameters

no -r -o tcp_keepinit=40 -o tcp_keepintvl=10 -o tcp_keepidle=600 -o tcp_sendspace=262144 -o tcp_recvspace=262144

VM parameters recommended especially for Oracle and 6.1!

vmo -r -o lru_file_repage=0 -o maxpin%=80 -o page_steal_method=1 \

-o strict_maxperm=0 -o minperm%=3 -o maxperm%=90 -o maxclient%=90 -o v_pinshm=1

Software

Commit left over updates

installp -c all

Uninstall some bloat

installp -gu bos.esagent bos.ecc_client.rte lwi.runtime csm.deploy

Extra BFF filesets from the AIX install kit

Install selected extra filesets

rm -f /tmp/install/bff/.toc

installp -acgXYd /tmp/install/bff/ all

This list of extras is specific to our site

# xlsmp.rte xlsmp_aix52.rte bos.content_list

# bos.adt.libm bos.cifs_fs.rte

# tivoli.tsm.client.api.32bit tivoli.tsm.client.ba.32bit.base

# tivoli.tsm.client.ba.32bit.common tivoli.tsm.client.ba.32bit.web

# gsksa.rte gskta.rte

# idsldap.cltbase61 idsldap.clt64bit61 idsldap.clt32bit61

These are our custom builds

# intl.openssh61 intl.openssl61 intl.net-snmp

Add some storage drivers

# xiv.hostattachment.tools xpyv

Filesets post-install configuration

openssh config

cp /tmp/install/config/sshd_config /etc/ssh/

TSM client

mkitab "dsmsched:2:respawn:/usr/tivoli/tsm/client/ba/bin/dsmc sched >/dev/null 2>&1 #TSM"

cp /tmp/install/conf/dsm.sys /usr/tivoli/tsm/client/ba/bin/

Open source tools in RPM format

rpm -ivh --nodeps /tmp/install/rpm/gettext-*

rm -f /tmp/install/rpm/gettext-*

rpm -ivh /tmp/install/rpm/*

updtvpkg

LDAP setup

Install custom LDAP configuration files

rm -rf /etc/security/ldap/

cp -r /tmp/install/ldap/ /etc/security/

cp /tmp/install/config/methods.cfg /etc/methods.cfg

restart-secldapclntd

Considerations for mksysbs

Reset RSCT / RMC info to avoid duplicate node IDs etc (should be run automatically?? See /usr/sbin/rsct/README/rsct.core.README)

/usr/sbin/rsct/install/bin/recfgct

--- THE END ---

Hobby server additions

Restrict setuid binaries to the minimum

fpm -l high

Create a modular syslog logging (one log per facility, separate directory for syslog files)

Make sure you mkdir every new dir and touch every logfile, and beware of files readable by everyone!

Example syslog.conf:

kern.debug /var/adm/ras/syslog/kern.log rotate time 1w

user.debug /var/adm/ras/syslog/user.log rotate time 1w

mail.debug /var/adm/ras/syslog/mail.log rotate time 1w

daemon.debug /var/adm/ras/syslog/daemon.log rotate time 1w

auth.debug /var/adm/ras/syslog/auth.log rotate time 1w

syslog.debug /var/adm/ras/syslog/syslog.log rotate time 1w

lpr.debug /var/adm/ras/syslog/lpr.log rotate time 1w

news.debug /var/adm/ras/syslog/news.log rotate time 1w

uucp.debug /var/adm/ras/syslog/uucp.log rotate time 1w

local0.debug /var/adm/ras/syslog/local0.log rotate time 1w

local1.debug /var/adm/ras/syslog/local1.log rotate time 1w

local2.debug /var/adm/ras/syslog/local2.log rotate time 1w

local3.debug /var/adm/ras/syslog/local3.log rotate time 1w

local4.debug /var/adm/ras/syslog/local4.log rotate time 1w

local5.debug /var/adm/ras/syslog/local5.log rotate time 1w

local6.debug /var/adm/ras/syslog/local6.log rotate time 1w

local7.debug /var/adm/ras/syslog/local7.log rotate time 1w

+Restrict access to syslog logs

Disable topasrec

chitab "xmdaily:2:off:/usr/bin/topasrec -L -s 300 -R 1 -r 6 -o /etc/perf/daily/ -ypersistent=1 2>&1 >/dev/null #Start local binary recording"

telinit q

Kill the topasrec process, remove leftover logs

find /etc/perf -type f ( -name \*topas -o -name \*log\* ) -exec rm {} \;

+Maybe configure nmon later

Configure sshd port and key based auth

Port 4321

PasswordAuthentication no

Make sendmail listen on localhost only (vi /etc/sendmail cf; refresh -s sendmail)

# O DaemonPortOptions=Name=MTA

O DaemonPortOptions=NAME=NoMTA4, Family=inet, Addr=127.0.0.1

Create a few new filesystems...

Misc

Setup WPARs based on template files

Disable system dump

Change default shell for users to bash ???

Enable bash completion

TODO

Some extra steps to consider:

increase /tmp /opt and further filesystems
add LDAP server to the /etc/hosts (IP address is required...)
run mksecldap
add LDAP users (addldapuser)

Update September 2012

- Install manuals: infocenter.man.EN_US.commands infocenter.man.EN_US.files infocenter.man.EN_US.libs

- Install every debug fileset: *.adt*

- # chdev -l sys0 -a iostat=true -a max_logname=16

Google Sites

Report abuse