#!/bin/sh
#
# ident @(#)spf_harden_os.sh	3.6 04/04/99 Sun Microsystems
#
# <from finish.spf>
#
# delete unwanted files
#
cat > /etc/inet/inetd.conf << EOF
#
# no services run on SPF
#
EOF

#
# fix name service to files/dns
#
cat > /etc/nsswitch.conf << EOF
passwd:     files
group:      files
hosts:      files dns
networks:   files
protocols:  files
rpc:        files
ethers:     files
netmasks:   files
bootparams: files
publickey:  files
netgroup:   files
automount:  files
aliases:    files 
services:   files 
sendmailvars: files
EOF
#
# this disables a vulnerability with volume management
#
cat > /etc/rmmount.conf << EOF
# Removable Media Mounter configuration file.
# File system identification
ident hsfs ident_hsfs.so cdrom
ident ufs ident_ufs.so cdrom floppy pcmem
ident pcfs ident_pcfs.so floppy pcmem
EOF

#
# Harden the OS by removing uneeded packages and files
# 
# "+" means must have
# "1" must delete for level 1
# "2" must delete for levels 1 and 2
# "#" is don't care

FILE_LIST="/opt/SUNWicg/SunScreen/lib/spf_harden_os.file_list"
PKG_LIST="/opt/SUNWicg/SunScreen/lib/spf_harden_os.pkg_list"

#
# read hardening level (default to 1)
#
level=".1"
if [ "$#" = "1" ] ; then
  level=".$1"
fi

#
# set architecture
#
arch=`uname -i | grep Ultra`

if [ ! "$arch" = "" ] ; then
  arch=".ultra"
else
  arch=".default"
fi

cat > /tmp/noask << EOF
mail=
instance=overwrite
partial=nocheck
runlevel=nocheck
idepend=nocheck
rdepend=nocheck
space=nocheck
setuid=nocheck
conflict=nocheck
action=nocheck
basedir=default
EOF

cat $PKG_LIST$arch$level | nawk         \
'{ str="pkginfo -q " $2 " >/dev/null 2>&1";	 \
   if ( $1 == "-") {     	 	 \
     test=system(str); 		         \
     if ( test == 0 ) {		         \
       cmd="echo \"y\" | pkgrm -a /tmp/noask " $2 " >/dev/null 2>&1"; \
       system(cmd);                      \
     }                                   \
   } else if ( $1 == "+" ) {             \
     test=system(str); 		         \
     if ( test != 0 ) 		         \
       print "WARNING: the package",$2, "is missing.";  \
   }                                     \
 }'

cat $FILE_LIST$arch$level | nawk         \
'{ str="ls -d " $2 " >/dev/null 2>&1";	 \
   if ( $1 == "-") {     	 	 \
     test=system(str); 		         \
     if ( test == 0 ) {		         \
       cmd="rm -r " $2 " >/dev/null 2>&1"; \
       system(cmd);                      \
     }                                   \
   } else if ( $1 == "+" ) {             \
     test=system(str); 		         \
     if ( test != 0 ) 		         \
       print "WARNING: the file",$2, "is missing.";  \
   }                                     \
 }'

