Startup

1. In /etc/inittab the line for local services must be present:

   rlcl::bootwait:/etc/rc.local >/dev/console 2>&1 # 4-char ID ! should be placed before ...
   vue :34:respawn:/etc/vuerc                      # ... VUE validation and invocation (9.x)
   

   Note that /etc/rc.local should exist and must have execute permissions:

   touch     /etc/rc.local
   chmod g+x /etc/rc.local
   chmod u+x /etc/rc.local
   

2. ! In /etc/rc.local
   set some protective network options:

   # set network options to improve performance and security
   echo "Setting network options"
   # protection against SYN flood attacks
   /usr/sbin/no -o clean_partial_conns=1
   # protection against ICMP redirects
   /usr/sbin/no -o ipignoreredirects=1
   # protection against illegal access via source routing
   /usr/sbin/no -o ipsendredirects=0
   /usr/sbin/no -o ipsrcroutesend=0
   /usr/sbin/no -o ipsrcrouteforward=0
   /usr/sbin/no -o ip6srcrouteforward=0
   /usr/sbin/no -o tcp_pmtu_discover=0
   /usr/sbin/no -o udp_pmtu_discover=0
   

3. ! In /etc/ssh/ssh_config
   enable ForwardX11
4. ! In /etc/ssh/sshd_config
   allow X11Forwarding, disable UsePrivilegeSeparation, and set the correct sftp-server location (/usr/sbin/sftp-server)
5. ! In /etc/rc.local ssh related startups

   startsrc -s prngd # not necessary for AIX 5.2 ?
   startsrc -s sshd
   

6. ! If "unsecure" services like rsh, ftp, et al, are to be enabled, use at least tcp_wrappers, in /etc/inetd.conf:

   ftp     stream  tcp6    nowait  root    /local/bin/tcpd       ftpd -l -u077
   shell   stream  tcp6    nowait  root    /local/bin/tcpd       rshd
   telnet  stream  tcp6    nowait  root    /local/bin/tcpd       telnetd -a
   login   stream  tcp6    nowait  root    /local/bin/tcpd 
   

   where /local/bin/tcpd is the actual TCP wrapper. In this case, root access from some machines may be allowed via /.rhosts:

   <machine>.gsi.de root
   

   The general format is

   <machine>.gsi.de root
   <machine>        root
   

   This list should be restricted to an absolute minimum, for admin purposes only.

Profiles

• /local/bin/.kshrc for ksh customization, example.
• /etc/profile will be executed during ksh login and should contain

  if [ ! "$DT" -a ! "$VUE" ]; then 
  ...                              # terminal stuff here
  fi
  
  if [ -x /local/bin/.profile ]
  then
    . /local/bin/.profile
  fi
  umask 022                       # u=rwx,g=r,o=r
  

  to allow for local definitions at login time. Ensure

  chmod a+x /etc/profile
  

• /local/bin/.profile contains local machine specific definitions, e.g. PATH, LIBPATH, MANPATH, ENV, which are set for all ksh users at login time. Example.
• Note that all stuff in /local/bin/ must be world-readable and -executable.
• user and root .profile's should contain

                  # HP-UX 9.x
  if [ ! "$VUE" ]; then
     ...
  else
  . /etc/profile
  fi
                  # HP-UX 10.x/11.x
  # VUE,CDE: execute profile
       if [   "$DT" -o "$VUE" ]; then
          . /etc/profile
       ...
  

  to allow login via desktop and non-desktop access.