KDE 3.3.1 for Solaris 9 Installation Instructions ================================================= This is a (relatively) simple write-up of the necessary steps required to get KDE 3.3.1 running on Solaris 9. PLEASE READ THE FOLLOWING FILES: ********************************************************* * * * REQUIRED.SUN.PATCHES * * REQUIRED-3.3.1/README.LDAP.SASL.KERBEROS * * I18N/README.I18N * * I18N/README.IMPORTANT * * * ********************************************************* ********************************************************************* I M P O R T A N T #1 It is very strongly recommended that the latest Solaris 9 Recommended Jumbo Patch Clusters be applied to your system, especially the patches pertaining to the Sun X Server, OpenGL and the C/C++ runtime. Usually, the latest Sun Recommended Jumbo Patch Cluster is the best way to go. ********************************************************************* ********************************************************************* I M P O R T A N T #2 You MUST increase the default soft and hard file descriptor limits per process. Please add the following two lines at the bottom of /etc/system (requires root privileges): set rlim_fd_max=8192 set rlim_fd_cur=1024 To take effect, the machine needs to be rebooted. After reboot, you can check that these limits went into effect by doing: %> ulimit -Sa [ ... snip ...] nofiles(descriptors) 1024 %> ulimit -Ha [ ... snip ...] nofiles(descriptors) 8192 Note: If your default soft and hard file descriptors limits were higher than 1024/8192 to begin with, you do not need to change this setting. ********************************************************************* ********************************************************************* I M P O R T A N T #3 Sun OpenGL 1.3 is REQUIRED for this distribution!!! http://wwws.sun.com/software/graphics/opengl/download.html ********************************************************************* I am assuming that the following packages have already been installed: - Java SDK 1.4.2_03 or better - Sun OpenGL 1.3 - Sun MediaLib 2 A minimal KDE installation requires the following packages: KDEkdedtlogin KDEqt KDEkderequired KDEkderuntime ***) KDEkdearts KDEkdelibs KDEkdebase KDEkdenetwork SUNWmlib J2SDK 1.4.2_03 or better Sun OpenGL 1.3 If you have already installed the KDEkderequired package from the KDE 3.3 distribution, you do not need to reinstall it. You only need to install the small new extra packages available under REQUIRED for 3.3.1. If you have not installed KDEkderequired from KDE 3.3, you must install this package, along with the small new extra packages provided with 3.3.1. ***) If you already have installed /usr/lib/libsunmath.so.1, you do not need to install the sunmath library. After all these packages have been installed, delete any leftover files, sockets and/or directories from inside the user-specific directories remaining from any previous KDE installation(s): /tmp/mcop-${USER}/* /tmp/kde-${USER}/* /tmp/ksocket-${USER}/* ${HOME}/.DCOPserver* ${HOME}/.mcop ${HOME}/.kde/socket- ${HOME}/.kde/tmp- It is recommended that you move the old ${HOME}/.kde directory to ${HOME}/.kde-. Using an older ${HOME}/.kde directory can sometimes cause minor problems or conflicts which can be easily avoided by starting with a clean ${HOME}/.kde. And then, make sure that the following KDE binaries are installed setuid root: artswrapper fileshareset kcheckpass kchmod kstartupcheck kdepasswd kdesud konsole_grantpty kpac_dhcp_helper kppp kdesud needs to belong to group nogroup. To achieve this: chgrp 65534 /opt/kde-3.3.1/bin/kdesud and then chmod 6755 /opt/kde-3.3.1/bin/kdesud Depending on which packages you chose to install, not all these binaries may be available. kchmod and kstartupcheck are automatically installed by KDEkdelibs. Warning: Do NOT install artsd setuid root. It will cause endless problems, for no real benefit. The response time is just fine without setuid root. 0. Locale ========= These Locale Instructions are applicable for ISO8859-* Locales ONLY. Separate Instructions for configuring UTF-8/Unicode Locales are available in the I18N subdirectory. The system locale should be defined system-wide. This is usually done by setting the NSLPATH and I18NPATH environment variables in the system shell initialization files. A typical locale setup on Solaris may look like this: export NSLPATH="/usr/lib/locale:/usr/lib/locale/en_US.ISO8859-1:/usr/openwin/lib/locale:/usr/openwin/lib/locale/en_US.ISO8859-1" export I18PATH="/usr/lib/locale:/usr/lib/locale/en_US.ISO8859-1:/usr/openwin/lib/locale:/usr/openwin/lib/locale/en_US.ISO8859-1" export LANG="en_US.ISO8859-1" export LC_CTYPE="en_US.ISO8859-1" export LC_NUMERIC="en_US.ISO8859-1" export LC_TIME="en_US.ISO8859-1" export LC_COLLATE="en_US.ISO8859-1" export LC_MONETARY="en_US.ISO8859-1" export LC_MESSAGES="en_US.ISO8859-1" export POSIXLY_CORRECT=1 export LC_ALL="en_US.ISO8859-1" Of course, you may have to adjust en_US.ISO8859-1 to your specific language setting. For example, the US English UTF-8 Locale is en_US.UTF-8. 1. Arts and Sound ================= - Make sure artswrapper is installed setuid root (it should be). - Make sure artsd is NOT installed setuid root. - The file ${HOME}/.mcoprc should contain only the following line: GlobalComm=Arts::TmpGlobalComm and should have permissions 0555 (to avoid it being overwritten by the Kontrol Center Sound & Multimedia configuration). This is because arts with x11GlobalComm does not always work. To enable sound in KDE (to hear the KDE startup tune, etc), you must do so in the Kontrol Center. Sound is NOT turned on by default. You may need to check the "use external player" box and enter 'artsplay' in the "Program" field. Also make sure that your audio device has the correct permissions (0644) set, and that it is correctly symlinked to /dev/audio. - Make sure that the file ${HOME}/.kde-3.3.1/share/config/kcmartsrc looks similar to this: [Arts] AddOptions= Arguments=\s-F 8 -S 2048 -a sun -d -n -b 16 -m artsmessage -l 3 -f AudioIO=sun AutoSuspend=false Bits=16 DeviceName= FullDuplex=true Latency=1 LoggingLevel=3 MessageApplication=artsmessage NetworkTransparent=true SamplingRate=0 StartRealtime=false StartServer=true SuspendTime=60 X11GlobalComm=true The most important parameters are 'Arguments' and 'AudioIO' (arts needs to be told to use the Sun audio device, otherwise, you will get scratches and static and it will sound like it does not work at all). You can fiddle around with the other parameters, and set them to your favorite values. The next step involves setting up the audio devices. Please create the following symbolic links on your machines (if they do not already exist): /dev/cdrom -> /devices/pci@1f,4000/scsi@3/sd@6,0:c /dev/dvd -> /devices/pci@1f,4000/scsi@3/sd@6,0:c /dev/vcd -> /devices/pci@1f,4000/scsi@3/sd@6,0:c /dev/mixer0 -> /devices/pci@1f,4000/ebus@1/SUNW,CS4231@14,200000:sound,audioctl /dev/dsp -> /devices/pci@1f,4000/ebus@1/SUNW,CS4231@14,200000:sound,audioctl Some of these symlinks may already exist on your machine. Also, some of the devices may be different, depending on your specific hardware. The next step involves configuring the Arts subsystem with the Arts Control Tool: - Start the Arts Control Tool - View -> View MIDI Manager - View -> View Audio Manager Using the MIDI Manager, choose Add -> aRts Synthesis MIDI Output, and select 'arts_all' from the pull-down menu. You should now see an entry for 'aRts Instrument (mapped)' in the Arts Control Tool. The first time you start KDE, you may see an error message from artsd pop-up on your screen (something like "assertion failed, objHandle" ...). It is prefectly safe to click OK and ignore this error message. If this happens, and you do not hear the KDE startup tune, just log out of KDE after it is fully started, and then log back in. You should no longer see the error message, and sound should be fully functional. If you still do not hear any sound at all after starting KDE a second time, please start KMix, make sure the Volume is not set to 0, and save your KDE session to automatically start KMix at KDE login. KMix's memory footprint is tiny. That's it! 2. Services =========== The DCOP interface in KDE calls getservbyname(3SOCKET). This requires adding an entry in /etc/services, to make the 'dcop' service known to the system -- and make getservbyname() work. As such, you need to add the following line in /etc/services: dcop 9700/tcp # KDE dcopserver service Caution: the _third_ field of this entry is left intentionally blank (i.e., the comment entry '# KDE dcopserver service' is the _fourth_ field). I use port 9700 for my DCOP services, but this is not a requirement. 3. PAM ====== KDE uses PAM for authentication. As such, the file /etc/pam.conf needs to be updated to permission KDE to run. This is the relevant portion of my own /etc/pam.conf file, pertaining to KDE (all spaces are actually tabs): ----- SNIP ---- # kde auth requisite pam_authtok_get.so.1 kde auth required pam_dhkeys.so.1 kde auth required pam_unix_auth.so.1 kde auth requisite pam_authtok_get.so.1 kde auth requisite pam_dhkeys.so.1 kde auth requisite pam_unix_auth.so.1 kde auth requisite pam_authtok_get.so.1 kde auth sufficient pam_dhkeys.so.1 kde auth sufficient pam_unix_auth.so.1 kde auth requisite pam_authtok_get.so.1 kde auth optional pam_dhkeys.so.1 kde auth optional pam_unix_auth.so.1 kde account requisite pam_roles.so.1 kde account optional pam_roles.so.1 kde account sufficient pam_roles.so.1 kde account required pam_unix_account.so.1 kde account requisite pam_unix_account.so.1 kde account sufficient pam_unix_account.so.1 kde account optional pam_unix_account.so.1 kde session optional pam_unix_session.so.1 # kcminit auth requisite pam_authtok_get.so.1 kcminit auth sufficient pam_dhkeys.so.1 kcminit auth sufficient pam_unix_auth.so.1 kcminit auth requisite pam_authtok_get.so.1 kcminit auth optional pam_dhkeys.so.1 kcminit auth optional pam_unix_auth.so.1 # kcminit account sufficient pam_unix_account.so.1 kcminit account optional pam_unix_account.so.1 # ksmserver auth requisite pam_authtok_get.so.1 ksmserver auth sufficient pam_dhkeys.so.1 ksmserver auth sufficient pam_unix_auth.so.1 ksmserver auth requisite pam_authtok_get.so.1 ksmserver auth optional pam_dhkeys.so.1 ksmserver auth optional pam_unix_auth.so.1 # ksmserver account sufficient pam_unix_account.so.1 ksmserver account optional pam_unix_account.so.1 # knotify auth requisite pam_authtok_get.so.1 knotify auth sufficient pam_dhkeys.so.1 knotify auth sufficient pam_unix_auth.so.1 knotify auth requisite pam_authtok_get.so.1 knotify auth optional pam_dhkeys.so.1 knotify auth optional pam_unix_auth.so.1 # knotify auth requisite pam_authtok_get.so.1 knotify auth sufficient pam_dhkeys.so.1 knotify auth sufficient pam_unix_auth.so.1 knotify auth requisite pam_authtok_get.so.1 knotify auth optional pam_dhkeys.so.1 knotify auth optional pam_unix_auth.so.1 # knotify account sufficient pam_unix_account.so.1 knotify account optional pam_unix_account.so.1 # dcopserver auth requisite pam_authtok_get.so.1 dcopserver auth sufficient pam_dhkeys.so.1 dcopserver auth sufficient pam_unix_auth.so.1 dcopserver auth requisite pam_authtok_get.so.1 dcopserver auth optional pam_dhkeys.so.1 dcopserver auth optional pam_unix_auth.so.1 # dcopserver account sufficient pam_unix_account.so.1 dcopserver account optional pam_unix_account.so.1 # kwin auth requisite pam_authtok_get.so.1 kwin auth sufficient pam_dhkeys.so.1 kwin auth sufficient pam_unix_auth.so.1 kwin auth requisite pam_authtok_get.so.1 kwin auth optional pam_dhkeys.so.1 kwin auth optional pam_unix_auth.so.1 # kwin account sufficient pam_unix_account.so.1 kwin account optional pam_unix_account.so.1 # kwin4 auth requisite pam_authtok_get.so.1 kwin4 auth sufficient pam_dhkeys.so.1 kwin4 auth sufficient pam_unix_auth.so.1 kwin4 auth requisite pam_authtok_get.so.1 kwin4 auth optional pam_dhkeys.so.1 kwin4 auth optional pam_unix_auth.so.1 # kwin4 account sufficient pam_unix_account.so.1 kwin4 account optional pam_unix_account.so.1 # kinetd auth requisite pam_authtok_get.so.1 kinetd auth sufficient pam_dhkeys.so.1 kinetd auth sufficient pam_unix_auth.so.1 kinetd auth requisite pam_authtok_get.so.1 kinetd auth optional pam_dhkeys.so.1 kinetd auth optional pam_unix_auth.so.1 # kinetd account sufficient pam_unix_account.so.1 kinetd account optional pam_unix_account.so.1 # konqueror auth requisite pam_authtok_get.so.1 konqueror auth sufficient pam_dhkeys.so.1 konqueror auth sufficient pam_unix_auth.so.1 konqueror auth requisite pam_authtok_get.so.1 konqueror auth optional pam_dhkeys.so.1 konqueror auth optional pam_unix_auth.so.1 # konqueror account sufficient pam_unix_account.so.1 konqueror account optional pam_unix_account.so.1 # kioslave auth requisite pam_authtok_get.so.1 kioslave auth sufficient pam_dhkeys.so.1 kioslave auth sufficient pam_unix_auth.so.1 kioslave auth requisite pam_authtok_get.so.1 kioslave auth optional pam_dhkeys.so.1 kioslave auth optional pam_unix_auth.so.1 # kioslave account sufficient pam_unix_account.so.1 kioslave account optional pam_unix_account.so.1 # kdesktop auth requisite pam_authtok_get.so.1 kdesktop auth sufficient pam_dhkeys.so.1 kdesktop auth sufficient pam_unix_auth.so.1 kdesktop auth requisite pam_authtok_get.so.1 kdesktop auth optional pam_dhkeys.so.1 kdesktop auth optional pam_unix_auth.so.1 # kdesktop account sufficient pam_unix_account.so.1 kdesktop account optional pam_unix_account.so.1 # ksmserver auth requisite pam_authtok_get.so.1 ksmserver auth sufficient pam_dhkeys.so.1 ksmserver auth sufficient pam_unix_auth.so.1 ksmserver auth requisite pam_authtok_get.so.1 ksmserver auth optional pam_dhkeys.so.1 ksmserver auth optional pam_unix_auth.so.1 # ksmserver account sufficient pam_unix_account.so.1 ksmserver account optional pam_unix_account.so.1 # kmail auth requisite pam_authtok_get.so.1 kmail auth sufficient pam_dhkeys.so.1 kmail auth sufficient pam_unix_auth.so.1 kmail auth requisite pam_authtok_get.so.1 kmail auth optional pam_dhkeys.so.1 kmail auth optional pam_unix_auth.so.1 # kmail account sufficient pam_unix_account.so.1 kmail account optional pam_unix_account.so.1 # kioslave auth requisite pam_authtok_get.so.1 kioslave auth sufficient pam_dhkeys.so.1 kioslave auth sufficient pam_unix_auth.so.1 kioslave auth requisite pam_authtok_get.so.1 kioslave auth optional pam_dhkeys.so.1 kioslave auth optional pam_unix_auth.so.1 # kioslave account sufficient pam_unix_account.so.1 kioslave account optional pam_unix_account.so.1 # kfmclient auth requisite pam_authtok_get.so.1 kfmclient auth sufficient pam_dhkeys.so.1 kfmclient auth sufficient pam_unix_auth.so.1 kfmclient auth requisite pam_authtok_get.so.1 kfmclient auth optional pam_dhkeys.so.1 kfmclient auth optional pam_unix_auth.so.1 # kfmclient account sufficient pam_unix_account.so.1 kfmclient account optional pam_unix_account.so.1 # kssld auth requisite pam_authtok_get.so.1 kssld auth sufficient pam_dhkeys.so.1 kssld auth sufficient pam_unix_auth.so.1 kssld auth requisite pam_authtok_get.so.1 kssld auth optional pam_dhkeys.so.1 kssld auth optional pam_unix_auth.so.1 # kssld account sufficient pam_unix_account.so.1 kssld account optional pam_unix_account.so.1 # kio_file auth requisite pam_authtok_get.so.1 kio_file auth sufficient pam_dhkeys.so.1 kio_file auth sufficient pam_unix_auth.so.1 kio_file auth requisite pam_authtok_get.so.1 kio_file auth optional pam_dhkeys.so.1 kio_file auth optional pam_unix_auth.so.1 # kio_file account sufficient pam_unix_account.so.1 kio_file account optional pam_unix_account.so.1 # kio_http auth requisite pam_authtok_get.so.1 kio_http auth sufficient pam_dhkeys.so.1 kio_http auth sufficient pam_unix_auth.so.1 kio_http auth requisite pam_authtok_get.so.1 kio_http auth optional pam_dhkeys.so.1 kio_http auth optional pam_unix_auth.so.1 # kio_http account sufficient pam_unix_account.so.1 kio_http account optional pam_unix_account.so.1 # kio_help auth requisite pam_authtok_get.so.1 kio_help auth sufficient pam_dhkeys.so.1 kio_help auth sufficient pam_unix_auth.so.1 kio_help auth requisite pam_authtok_get.so.1 kio_help auth optional pam_dhkeys.so.1 kio_help auth optional pam_unix_auth.so.1 # kio_help account sufficient pam_unix_account.so.1 kio_help account optional pam_unix_account.so.1 # kio auth requisite pam_authtok_get.so.1 kio auth sufficient pam_dhkeys.so.1 kio auth sufficient pam_unix_auth.so.1 kio auth requisite pam_authtok_get.so.1 kio auth optional pam_dhkeys.so.1 kio auth optional pam_unix_auth.so.1 # kio account sufficient pam_unix_account.so.1 kio account optional pam_unix_account.so.1 # kscreensaver auth requisite pam_authtok_get.so.1 kscreensaver auth sufficient pam_dhkeys.so.1 kscreensaver auth sufficient pam_unix_auth.so.1 kscreensaver auth requisite pam_authtok_get.so.1 kscreensaver auth optional pam_dhkeys.so.1 kscreensaver auth optional pam_unix_auth.so.1 # kscreensaver account sufficient pam_unix_account.so.1 kscreensaver account optional pam_unix_account.so.1 # xscreensaver auth requisite pam_authtok_get.so.1 xscreensaver auth sufficient pam_dhkeys.so.1 xscreensaver auth sufficient pam_unix_auth.so.1 xscreensaver auth requisite pam_authtok_get.so.1 xscreensaver auth optional pam_dhkeys.so.1 xscreensaver auth optional pam_unix_auth.so.1 # xscreensaver account sufficient pam_unix_account.so.1 xscreensaver account optional pam_unix_account.so.1 # session auth sufficient pam_pwdb.so session auth optional pam_pwdb.so # session account sufficient pam_pwdb.so session account optional pam_pwdb.so ----- SNAP ----- 4. FAM ====== This release of KDE uses FAM, which also needs to be authenticated via pam. Here are the relevant entries for /etc/pam.conf for FAM: ----- SNIP ----- # fam auth requisite pam_authtok_get.so.1 fam auth sufficient pam_dhkeys.so.1 fam auth sufficient pam_unix_auth.so.1 fam auth requisite pam_authtok_get.so.1 fam auth optional pam_dhkeys.so.1 fam auth optional pam_unix_auth.so.1 # fam account sufficient pam_unix_account.so.1 fam account optional pam_unix_account.so.1 # ----- SNAP ----- FAM also needs its own configuration file (/opt/fsw4sun/etc/fam.conf) as well as the two entries in /etc/inetd.conf and /etc/rpc, respectively: The entry in /etc/inetd.conf looks as follows: ----- SNIP ----- # SGI File Alteration Monitor (FAM) sgi_fam/1-2 stream rpc/tcp wait root /opt/fsw4sun/bin/fam fam ----- SNAP ----- and the entry in /etc/rpc: # SGI File Alteration Monitor sgi_fam 391002 fam # SGI File Alteration Monitor And here is a copy of my own /opt/fsw4sun/etc/fam.conf file: ----- SNIP ----- # fam.conf # # For more information on the configuration options below, see the # fam(1M) man page. # # insecure_compatibility disables authentication. This causes # untrusted_user to be ignored, because the UID presented by every client # connection will be believed. # # The -C command-line argument overrides this option. # insecure_compatibility = true # # untrusted_user is the user which will be used for unauthenticated # clients. If a file can't be stat'ed by this user, those clients won't be # able to fam it. The value can be a user name or a numeric UID. # untrusted_user = nobody # # local_only makes fam ignore requests from remote clients & remote fams. # Note that this is ignored if fam is started by inetd. # # The -L command-line argument overrides this option. # local_only = false # # xtab_verification makes fam check the list of exported filesystems to # verify that requests from remote hosts fall on filesystems which are # exported to the hosts. # xtab_verification = true # # idle_timeout sets the number of seconds fam will wait for new # connections before quitting. A value of zero will cause fam to # wait indefinitely. The default is 5. # # The -T command-line argument overrides this option. # idle_timeout = 5 # # nfs_polling_interval sets the number of seconds between polling files # on NFS filesystems. The default is 6. # # The -t command-line argument overrides this option. # nfs_polling_interval = 6 ----- SNAP ----- 5. NAS ====== This release of KDE fully supports NAS (Network Audio Server). The nasd configuration file (nasd is the NAS daemon) can be found in /opt/fsw4sun/etc/nasd.conf. The NAS server (nasd) also needs an entry added to /etc/services, as follows: nasd 8000/tcp # NAS Audio Server 6. GhostView and XScreenSaver ============================= There are two configuration files for GhostView (GV) and XScreenSaver (XScreenSaver) which can be found in /opt/fsw4sun/X11/app-defaults. These two files should be manually copied to /usr/openwin/lib/app-defaults. For KGhostView, you should remove all the extra arguments which are enabled by default in KGhostView -> Settings -> Ghostscript. The values for both "Non-antialiasing arguments" and "Antialiasing arguments" should be only: -I/opt/fsw4sun/share/ghostscript/8.11/fonts 7. CUPS ======= A full CUPS binary distribution is included in the kderequired package, and installs under /opt/fsw4sun/cups-1.1.19. Sample /etc/rc3.d startup scripts are available in /opt/fsw4sun/cups-1.1.19/etc. 8. VNC Server ============= The VNC Server from realvnc.com does not seem to work correctly on Solaris. However, the LibVNCServer 0.6 software, written by Johannes E. Schindelin, works very well, even between KDE and Windows XP. For Windows XP, you can use the prebuilt VNC binary distribution from realvnc.com. A full build of LibVNCServer, including sample startup scripts, can be found in kderequired, and installs under the /opt/fsw4sun directory. 9. TrueType fonts and antialiasing ================================== A very detailed and clear explanation on how to enable antialising for TrueType fonts in Solaris 8 and 9 can be found at: http://developers.sun.com/dev/gadc/techtips/adding_fonts.html ttmkfdir, fontconfig and freetype can be found in the kderequired package. A good source for (relatively) free TrueType fonts: http://www.1001freefonts.com/ TrueType font rendering on Solaris 9 is orders of magnitude better than on Solaris 8. I have installed the fonts from 1001freefonts and they all work. 10. XPlanet and XGlobe ====================== XPlanet-1.1.1 and XGlobe-0.51 are available in the kderequired jumbo package from the KDE 3.3.0 distribution. For more information about configuring these programs, please visit the following URL's: http://hans.ecke.ws/ http://xplanet.sourceforge.net/ http://www.cs.unc.edu/~scheuerm/xglobe/ You will find tons of configuration scripts, FAQ's, HOW-TO's, etc. 11. KDE Specific Environment Variables ====================================== Please make sure the following Environment Variable is set in your shell initialization files (.cshrc, .bash_profile, .profile, ...): for bash or ksh: export KDE_IS_PRELINKED="1" for csh or tcsh: setenv KDE_IS_PRELINKED "1" Without this setting, things will misbehave. :-) You no longer need to set KURLCOMPLETION_LOCAL_KIO. That bug is fixed. Important Note about Scribus 1.2 and KDEkderequired =================================================== An old build of Scribus was inadvertently left over in /opt/fsw4sun/{bin,lib} when i built the KDEkderequired package. This is a bad build, and it does not work. It SIGSEGV's constantly. The Scribus 1.2 package, which is very stable, installs in /opt/kde-3.3.1/{bin,lib}. This is the Scribus you should use. You can safely remove the bad Scribus build in /opt/fsw4sun, after installing KDEkderequired: root#> cd /opt/fsw4sun root#> find . -name "*scribus*" -exec rm -rf {} -print ./bin/scribus ./include/scribus ./lib/scribus root#> 12. Finishing the installation ============================== After installing all the KDE modules you choose, and editing the necessary system configuration files, please make absolutely certain that all these configuration files are restored to their original access permissions. Solaris 9 is very security-conscious about lax permissions on configuration files. I have received several confirmed reports that, wrong permissions on /etc/pam.conf (0664 instead of 0644), for example, will prevent anyone from logging in.