What filesets are safe to remove from HP-UX if not used?

[Iustin Pop]

Hello to all,

If I don't use some filesets installed by default, and if nothing depends on them, are they safe to remove? What are the guidelines for trimming down a server installation?

For example: ASIAN-* if I don't use the asian environment, CIFS-src, mysql, etc.

Thank you,
Iustin Pop

[Michael Tully]

There are quite a number of filesets that can be removed and safely as well. This largely depends on the server and what it is used for. NLS (native language) is quite an obvious choice and be removed without any problems. ANother is NFS (part of it can be)
man pages if you don't want them. CIFS (samba). I'm sure there will be quite a list. Is this a security related question, or a space releated question? If it is space, perhaps look at increasing /opt /usr or even /var using an ignite tape.

[Iustin Pop]

It is more a security issue. I come from the GNU/Linux world where I'm used to do a minimum install (like < 100 MB) and then add just the bits I need. After installing HP-UX, I find there are Xserver, CDE environment, and other software we won't use (but which can't be removed due to dependecies and this makes sensee); at least I try to isolate the parts we won't use and swremove them.

Thanks for the answer.

[Michael Tully · Accepted solution]

The common document that is followed as far as security is concerned is called building a bastion. Below is a link to this document. Not sure if this is this the latest one or not, but can used as a guideline.

http://secinf.net/unix_security/Building_a_Bastion_Host_Using_HPUX_11.html

There are a few other file sets that comes to mind:
apache - if you don't use it
CDE
PPP-RUN
SNMP - if not using additional management software

DOn't forget these could be needed for third party offerings, so be aware of this.

[dirk dierickx]

my origin is from the gnu/linux world as well, and i found this to be a problem as well. the OS image ends up to be one big installation, which doesn't make it easier to remove (or later on _add_ them again !!) packages.

i've seen and followed up on the bastion guides and installed bastille etc. but it changes nothing to the common security idea that less code/binaries means less possible security holes.

so far i haven't found a good solution to it, though i also remove some other languages and audio/video software and netscape/mozilla (wtf is that doing on a server anyway?) etc.

[Iustin Pop]

Well in the end I managed to remove:
- all non-english man pages, message catalogs, etc.
- CDE except for CDE-HELP-RUN which is needed by STM
- NIS-SERVER, but not NIS-CLIENT since a patch which is needed by ShadowPasswords install only on NIS-CORE
- some other stuff...

What I didn't manage to remove, although I'd like:
- Xserver, which is needed by X clients.RUN, although I don't understand why, I only want to run some tools on an X server on another machine

In the end, I learned much about depots and how the dependecies are managed; whereas in package managers used under GNU/Linux you depend on the whole package, with depots you can depend just on a fileset from a depot, which eases the dependency problems.

Thanks again,
Iustin

[Adrian Sobers2]

I'm looking to do much of the same but it is a
space related problem.

What is the step by step way to remove unwanted filesets on HP-UX 11.00?

[Robert-Jan Goossens_1]

Adrian,

Please open a new thread for your question.

add the output from a swlist command.

Best regards,
Robert-Jan

[Iustin Pop]

Closing thread.