AIX Build Check List 1

[KPKIND]

Hi Guys,

Do anyone of you have a complete check list for builiding an AIX server (say for production use)? If so it would be great if you can share that. I have prepared a list of steps but wanted to cross check to ensure I am not missing any of the crucial steps.

TIA
Kumar

 

[alexhu]

Show me yours first

Alex

 

[Mag0007]

you want this

http://aplawrence.com/MDesrosiers/aixhardening.html

very good resource.

good luck

 

[letis]

hello,

i've got a list of parameters to check after an AIX install :

- always check the network config :
- ping your IP address
- ping GW and DNS IP address
- ping your hostname
- ping a remote hostname

- recent machines have 2 ethernet port, so It could be a good idea to use the 2nd port with a maintenance IP address (192.168.1.1 for instance), for direct connection to the system if needed.

- configure a TTY
- have the login "enabled" on a tty, for maintenance purpose

- unset most of the system limits :
- edit /etc/security/limits, put them all to -1 (unlimited),
except nofiles which can remain at 2000

- configure the maximum number of process per user
- smit => environment => characteristics of operating system

- check the memimum number of users
- smitty => environment number of licensed users

- create needed volume groups and paging spaces
- if several paging spaces, have them of equal size and on
different physical volumes; at least x 1.5 the amount of RAM;

- configure the dump (activate it and check there's enought free space in
/var/adm/ras);

- install additional AIX components (performance tools, mathematic library for
example)

- apply the latest maintenance level if this is a test machine; if production system apply the maintenance level with which the environment have been qualified; in case of dubt, apply the latest ML if not too recent (if it is more than 2 weeks), otherwise install ML at n-1.

- decide AIX VMM parameters
- maxperm, maxclient, minperm, minfree, maxfree


- decide if you want to maintain disk I/O history.

- tpe lppchk -v and diags -a to check SW and HW are okay.

Well I don't see more, if anyone has suggestions ...

regards,

 

[RMGBELGIUM]

- set up system accounting
- restrict remote logins for users
- when installing AIX, enable Trusted Computer Base, and if you want it really, really, really, really secure enable the CAPP option ( not recommended if you don't wanna get frustrated )
-when creating volumegroups, be sure to make them big VG's and set quorum off
-when creating Filesystems, choose type jfs2


regards,

R.

 

[spamly]

-ensure your firmware is up to date (wsm)

 

[KPKIND]

Thanks everyone. Except the step of configuring tty I had rest all in my Check list. Anyway Thank you very much.