Monday, October 26, 2009

AIX syslogd and splunk (and more)

AIX is what I would call a 'batteries not-included' OS; the vanilla DVD install leaves you with a functioning system that has telnet (with root access) enabled, no OpenSSL/OpenSSH, korn shell without autocomplete (must be enables 'set -o vi'), no logging, etc...
Since I work around a lot of RedHat boxes I tend to modify the AIX servers to have a simlar setup to RHEL, here are some of the steps I take:

Install the following rpm's from the aix toolbox:
bash (add /usr/bin/bash to /etc/security/login.cfg)
curl
coreutils
less
lsof
python
rsync
sudo
unzip
wget

Install OpenSSL and OpenSSH

Change root home directory to /root and change shell to bash:
mkdir /root && chuser home=/root shell=/usr/bin/bash root
Modify prompt for all users:
# Set bash prompt to be much more linux like
if [[ "$TERM" == "xterm" ]];then
if [[ "$SHELL" == "/usr/bin/bash" || "$SHELL" == "/bin/bash" ]];then
if [[ "$UID" -eq 0 ]];then
PS1="\[\033]0;\u@\h:\w\007\][\[\033[31;1m\]\u\[\033[0m\]@\h \W]# "
else
PS1="\[\033]0;\u@\h:\w\007\][\u@\h \W]\$ "
fi
fi
fi
Change logging setup:
# Linux-ify the AIX logging setup and enable automagic rotation
# Everything but mail and auth to messages
*.info;mail.none;auth.none /var/log/messages rotate size 10m files 10 compress
# Auth to secure
auth.debug /var/log/secure rotate size 10m files 10 compress
# Mail to maillog
mail.debug /var/log/maillog rotate size 10m files 10 compress
# Emergency messages to all users
*.emerg *
*.info;mail.none @NETWORK_LOG_SERVER
Remove "Message forwarded from hostname:" from remote logging output:
chssys -s syslogd -a "-n" ; stopsrc -s syslogd ; startsrc -s syslogd
Run aixpert to enable a much higher level of security:
aixpert -l high