1*0Sstevel@tonic-gate# 2*0Sstevel@tonic-gate# CDDL HEADER START 3*0Sstevel@tonic-gate# 4*0Sstevel@tonic-gate# The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate# Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate# (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate# with the License. 8*0Sstevel@tonic-gate# 9*0Sstevel@tonic-gate# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate# or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate# See the License for the specific language governing permissions 12*0Sstevel@tonic-gate# and limitations under the License. 13*0Sstevel@tonic-gate# 14*0Sstevel@tonic-gate# When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate# If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate# fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate# information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate# 20*0Sstevel@tonic-gate# CDDL HEADER END 21*0Sstevel@tonic-gate# 22*0Sstevel@tonic-gate# 23*0Sstevel@tonic-gate# Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate# Use is subject to license terms. 25*0Sstevel@tonic-gate# 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate#pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate Notes Regarding Modification of generic_open.xml 30*0Sstevel@tonic-gate 31*0Sstevel@tonic-gateAny changes made to generic_open.xml will need to be considered for 32*0Sstevel@tonic-gateinclusion in generic_limited_net.xml, the "Secure By Default" (see 33*0Sstevel@tonic-gatehttp://solsec.eng.sun.com/sbd/) profile. The details are discussed 34*0Sstevel@tonic-gatein PSARC/2004/781: 35*0Sstevel@tonic-gate 36*0Sstevel@tonic-gate ... 37*0Sstevel@tonic-gate The generic_limited_net profile explicitly disables all 38*0Sstevel@tonic-gate smf(5) converted inetd services that are not required to 39*0Sstevel@tonic-gate run the window system, SVM, or vold. It retains ssh and 40*0Sstevel@tonic-gate X remote login as the remote login methods available. 41*0Sstevel@tonic-gate ... 42*0Sstevel@tonic-gate 43*0Sstevel@tonic-gateIn general, _any_ service that allows inbound net access should be 44*0Sstevel@tonic-gateadded to generic_limited_net and disabled, unless its activation 45*0Sstevel@tonic-gatehas been:approved by SBD. 46