When processes are managed, two concepts come up, they are the Real and the Effective ID of the process. To detail the difference, you have to understand the Difference between setuid / setgid / sticky bits.

The Real ID is the ID of the user that started the process, suppose that the process was started by program with setuid or setgid, this special permissions are from another user, that users ID is the so called “Effective ID”, the users ID whoes privileges where obtained by the setuid/setgid, basically, the owner of the executable.

To change a file permission the “chmod” command is used. This command has the following format in Solaris:
chmod [-fR] <permissions> <fileName>
-f : Is to force, if there is an error, nothing is displayed.
-R : Does the change recursivelly.

But let go to the point, the setuid bit permits that the process, produced by executing the program, has granted the permissions based on the owner of the file (not the permissions from the user that executed the program).

The same occurs with setgid, the group permissions from the file are used for the process.
This is usefull to give a normal user, access to a resource he would not be able to access, through the execution of the program. This is also a security flaw, imagine if the file’s owner is root, this is usually the kind of files the intruders search for, and they look also for a programming defect, and try to exploint that problem.

Sticky Bits
To improve security, the Sticky Bits come to rescue. They prevent that the user do not deletes files that he do not owns.

Setting setuid
chmod 4755 testProgram
The permissions would look like: rwsr-xr-x

Setting setgid
chmod 2755 testProgram
The permissions would look like: rwxr-sr-x

Setting setuid/setgid
chmod 6755 testProgram
The permissions would look like: rwsr-sr-x

Setting Sticky Bits to a directory
chmod 1777 testProgram
The permissions would look like: drwxrwxrwt

1. Enable rlogin
In the latest versions of Solaris Rlogin comes disabled by default. To enable it you have to use Service Control System:
svcs enable svc:/network/inetd:default
svcs enable svc:/network/login:rlogin

2. Secure rlogin
If you do not need the .rhosts file, delete them from the users home directory. This file has server names and ip addresses from where the user can login without being asked for a password, this means a security risk.

The same risk exists if a hostname is listed in /etc/hosts.equiv, this file is like a “global .rhosts” file and if an ip address or hostname is in that file, any login from those machine is not going to request a password. The file /etc/hosts.equiv can also specify a username, in the form:
10.10.10.45 walter
Or just an ip address:
10.10.10.45

It is possible to disable the $HOME/.rhosts and /etc/hosts.equiv files, globaly by commenting a line in /etc/pam.conf.
The line to comment is:
#rlogin auth sufficient pam_rhosts_auth.so.1

1. Enable FTP

In this article i am going to explain the simple steps required to enable (start) the FTP Server in Solaris 10 and also securing the service.

First look if the service is enabled:
svcs -a | grep ftp

If the service is disabled, start it (As root):
svcadm enable svc:/network/ftp:default
2. Securing FTP

To secure ftp you are going to work with 3 files:
/etc/ftpd/ftpusers
/etc/ftpd/ftphosts
/etc/shells

The file /etc/ftpd/ftpusers:
This file lists the users that DO NOT have access, use it to deny access to certain users.

The file /etc/ftpd/ftphosts:
Here is listed the user and the rule (deny or allow) with a hostname or ip address.

For example:

And if i try to login with the correct username and password:

The file /etc/shells:

This file lists the shells that can be used in a remote session to this host, if the users shell (that appears in /etc/passwd) is not listed here, the user is not going to be able to login. This is another way of disabling the access to a user of group of users.

To reject any attempt to login as root remotely (ssh, rcp, ftp) you have to modify the file:
/etc/default/login
And, uncomment the line that says:
CONSOLE=/dev/console
If console is set, root can only login from that device.

Create the file /var/adm/loginlog, the failed login attempts are going to be logged in this file. It should be created as the root user, and then:


chmod 600 /var/adm/loginlog
chgrp sys /var/adm/loginlog


If the unsuccesful login attempts are bellow 5 for a user account, it would not log, but this can be setup while editing /etc/default/login and set:


SYSLOG_FAILED_LOGINS=0


The /var/adm/loginlog file has:

account name, tty device, time of failed login attempt.

Something bad could happen if you delete /etc/vfstab by mistake and you do not have a backup, the system would not find the required partitions to boot, they are: root (/), /usr, and /var.

To recover it, if you realialized that the /etc/vfstab file has been deleted but do not rebooted yet, you can accomplish this with “mount -p”.

The mount command is used to mount a filesystem to a directory tree.

mount [<options>] [-o <specificOptions>] <mountDevice> <mountPoint>

The options can be:

-F <FSType> : The type of filesystem to mount can be specified.

-m : Mount the filesystem without updating the entry in /etc/mnttab

-p : Print the mounted filesystems in a vfstab file format.

-r : Mount the filesystem in ReadOnly mode.

-v : Display the mounted filesystems list in verbose mode.

I needed to convert some ANSI screens to ASCII to capture some data, finally i had to hack a little with sed and regular expressions, this may help a lot of pleople with similar problems:


sed 's/^\x20//g' < test.log > test.2
sed 's/\x1B\[[0-9]*;*[0-9]*.//g’ < test.2 > test.3


Hard and Symbolic links are the two types of files that exist in a Unix Operating System to point to another file.

Hard Links: They are a pointer that is exactly as the same than the file it points to, no mather if it has a different name, any modification done to the pointer are also done to the target file. The hard links can only point to other files, but not directories (though directories are a special kind of files). And the other main difference with Symbolic Links is that hard links MUST reside in the same filesystem than the file they point to, because they have the same inode number.

Symbolic liks: The are a pointer to another file but they contain the name of the file they point to, it can span filesystems (they have a different inode number), and they can point to files or direcoties.

Creating Hard and Symbolic Links:
ln [-fns] <source> [<target>]
By default ln (without arguments) it creates hard links.
-f : force, links the file without asking.
-n : If <target> exists, don’t overwrite the content of the file (-f overrides this option)
-s : Create a Symbolic Link.

If you have already read the Managing patches in Solaris (Part I) and now you want to know more, keep reading ! This time i am going to explain how to remove a patch, this action restores the previously saved files (except that you used the -d option with patchadd).

The syntax is this:

patchrm [-f] [-G] -B [<backOutDir>] <patchId>

-f : Forces the removal, event if the patch where superseded by another patch, this is not recommended.
-G : Removes the patch from the current Zone only, in case you are removing a patch from a Zone (Zones are going to be explained in another post).
-B : Saves the backOut data in this directory
<patchId> : This is a patch in the form of 105754-10