How to reconcile services?

Question

To support a large number of Solaris 10 machines, I need a way
to establish an initial configuration of services, and to modify that
configuration from time to time. Taking the inetd restarter as an
example, I used to keep copies of /etc/inet/inetd.conf in a central
location, installing them on each machine in a Jumpstart finish
script. Commenting out lines in the file would disable those
services.
This no longer works in build 69. It's possible to convert an
netd.conf file into services that run under the inetd restarter,
but commented out lines don't disable the corresponding
service. What I'm thinking of for Solaris 10, is to run `inetadm'
to get a file containing the current set of inetd services. The
output shows the enabled/disabled status in the first column.
Then, I'd create a second file, starting with a copy of the first one,
but with the first column modified to show the desired status.
A script could then compare the two files, and and issue `inetadm'
commands to change the status of services to match the desired
status.
Is this a reasonable approach? Does anything like this facility
already exist, or is planned? I'd also need to do the same thing
for services that run under the default restarter. The objective
is to be able to specify a set of enabled services for each
machine, and ensure that the machine is running with only those
services enabled. We have a procedure now that makes those
types of adjustments periodically , or on request.
I also want to take properties into account, particularly for inetd
services. I notice that inetd no longer looks at /etc/default/inetd.
I've been enabling TCP wrappers from that file. Now, I have to do
it by changing properties of inetd or of services that run under it.
There is also the issue of locally-installed services. I've taken the
approach of writing manifests for them, an installing them in the
Jumpstart finish script. Is this a reasonable approach? I still have
the problem of enabling or disabling those services, as required.

Answer 1

Are there any services that should not be disabled
initially, but can be disabled later?Services ending with "-upgrade" tend to disable themselves after running on first boot. Depending on whether you need SVM or not, you may be able to disable the various "meta" services.
I'm also going to install manifests for
locally-installed services
into /var/svc/manifest/site in the Jumpstart finish
script. I have
one that ensures that a specific NFS mount has
succeeded,
for example. Is there a similar place for
locally-installed
methods? I've been using /lib/svc/method .We haven't reserved a location for site methods, as they can be placed anywhere in the filesystem. (I'll think about making a site directory in /lib/svc.) If you name your methods with some unique prefix, you'll be fine. (At home, where I play the role of hobbyist admin, I put such methods in /etc/[my_domainname], or in /opt/[my_domainname], depending on when they're needed in boot.
- Stephen