HP/UX - What to do post install?

[Tim Krego_1]

We just got in our second K460 machine. I did not set up the first machine and our sysadmin/dba is no longer with us. So that leaves just me to learn everything I can ASAP.

I installed HP/UX 11.00 with any major problems. I have started to partition the rest of the disks with LVM.

What I am looking for is what additional software and setup I need to do now that the initial OS install is complete. I have 4 CD's with additional software along with a patch CD.

The HP documentation I have doens't really cover the "insider tips" stuff and I haven't found a good resource for that yet.

Any pointers in the right direction are greatly appreciated. (and points awarded)

Thanks,
Tim Krego

[Charles Harris]

Tim,

This is the grail! - post install is usually just a case of configuring all services, telnetd, ftp etc and network configurations etc.

It's a bit of a broad subject without any specific ideas of what you want.

Rgds,

-ChaZ-

[John Poff]

Tim,

If you want your new machine to be similar to your first K, you can start by comparing the kernel parameters. See what everything is set for on the first box and set the corresponding parameter on the second box to be the same.

Also, you can use 'swlist' to see what products and patches are installed on the first box, and get those put on the second box. Try 'swlist -l product' to see what you might need.

JP

[Paula J Frazer-Campbell]

Hi
Normal procedure is:-

1. Install

2. additional software Hp

3. Patch

4. Configure

5. Database/ application software

6. Data

7. Test

8. Patch and fix.

HTH

Paula

[John Waller]

Tim,

As Charles pointed out, the scope for the is enormous.

Before you start installing you need to find out what software is required and also the relevant Licence Codes.

The main way to install additonal software is to use the swinstall command. This is a type of menu driven software which allows you to install extra software or patches. One of the menus has the option to enter code words which "unlocks" licenced software from the Application CD's.

To be honnest, if you are totally new to HP-UX and setting up a server from scratch I would seriously look at buying some training or at least find a good consultant who will come in and setup the box , but also will explain at the same time what he is doing.

[James R. Ferguson]

Hi Tim:

If I understand correctly, you have installed the CORE OS cdrom but nothing from the Application CDs and/or the SupportPlus CD. If this is the case, you need to do the following.

For each Application CD (there are currently five), mount the CD and run 'swinstall'. Add the codeword for each "application" for which you are licensed. For example, if you have licensed MirrorDisk/UX you will have a codeword for it (or can get one). Add the codeword and install the product(s) on this CD.

After loading (and rebooting as necessary) all of the Application products, use the current SupportPlus CD and load diagnostic software (EMS, Predictive Support and STM). The correct depot for these is /cdrom/DIAGNOSTICS/B.11.0/ (note the capital letters).

After loading diagnostic software, load the current General Release (GR) patch bundle from the SupportPlus CD.

This cycle of software loads (in order) will yield a well-setup system if you use current software. After that, you can begin configuration and customization.

...JRF...

[A. Clay Stephenson]

Hi Tim,

It appears that the others have given you the setup but now I would do a make_recovery so that I don't have to do this again. Also, don't forget to configure your new node into whatever backup scheme you use (OmniBack, Veritas, fbackup, tar, ...)

Regards, Clay

[Victor BERRIDGE]

I agree also,
I would suggest after creating your tape (make_recovery -A )to test it straight behind and if you can, on an another disk, and try to boot from it, that means booting in single user, interract with IPL, choose boot device (your DDS tape)
You can even go and test the interacive procedure of make_recovery to:
1)Install on another disk (as mentionned above)
2) change the config (size of file system etc...)
Welcome and Good luck
Victor

[Bill Hassell · Accepted solution]

In addition to what has been suggested, you will need to fix all the problems and make the system easier to manage by:

1. set umask in /etc/profile: umask 022

2. fix /usr/local: find /usr/local -type d -exec chmod 755 {} \;

3. Move root's $HOME: mkdir /root, then edit /etc/passwd accordingly, then move all ordinary files in / to /root including . files like .profile and so on.

4. Edit /etc/profile and change the copyright message to something like:

echo "To read copyright message, use cat /etc/copyright"

5. Fix /etc/issue by putting just the name of the system and nothing else

6. Fix /etc/inetd.conf by adding:

-b /etc/issue (to telnetd)
-B /etc/issue (to rlogind)

7. Edit /etc/mail/aliases to redirect root's email to a live person's email address, then run newaliases.

8. Edit /etc/resolv.conf and /etc/nsswitch.conf to match your needs.

9. Create /etc/securetty: echo console > /etc/securetty (or simply: echo "" > /etc/securetty) which now requires root to always login as a user and then su to root.

10. Setup /etc/ntp.conf and enable in /etc/rc.config.d/netdaemons (if not using NTP, start...)

11. Scan your new system for bad permissions:

find / /opt /usr -xdev -type f -perm 666
find / /opt /usr -xdev -type f -perm 777
find / /opt /usr -xdev -type d -perm 777

The man/cat* directories are OK as well as /tmp, but the others usually need fixing.

12. Make sure all non-vg00 mountpoints are correct. They should be a minimum of 755, perhaps even more restrictive. In general ANY file or directory with 777 permissions must be assumed WRONG and action taken to correct the situation. Exceptions are /tmp and the man/cat* directories. Similarly, all databases should be owned by the database user and not readable by others.

13. Add nosuid to all fstab mountpoints except /usr and /opt. This is especially true for /tmp which should also have the sticky bit set using: chmod +t /tmp (to prevent users from deleting each other's files)

All of these fixes are important and may not have been done on other machines...go back and fix them. If a global umask has not been set for since installation, root may have accidently created a large number of security problems (which the above find commands will locate).

[John Payne_2]

Tim,

If you are in Hawaii, The Bahamas, the South Pacific, etc, I would be more than happy to have you fly me out to help you with your machines. I'd do it gratis if you got me there...