topic Re: shutdown ports in Operating System - HP-UX

shutdown ports

Ratzie — Fri, 05 Dec 2003 12:48:55 GMT

I had a security audit done on my HP 11.00 server and would like to shut down some ports that are not being used.
I know that you can modify the /etc/inetd.conf file for some but I have some others that I need to shut down...
Where do I do that?

25 smtp
80 http
111 SunRPC
119 News
135 epmap
512
1080
8080
68 bootpc

As well as shut down the smtp server and the snmp service

Re: shutdown ports

Paula J Frazer-Campbell — Fri, 05 Dec 2003 12:49:55 GMT

Hi

/etc/services

Paula

Re: shutdown ports

Steven E. Protter — Fri, 05 Dec 2003 12:53:09 GMT

This product might help as well.

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B9901AA

IPFilter.

SEP

Re: shutdown ports

RAC_1 — Fri, 05 Dec 2003 12:57:35 GMT

/etc/services is the file.

Re: shutdown ports

Uday_S_Ankolekar — Fri, 05 Dec 2003 12:59:07 GMT

/etc/services file. We can just put # at the begining of the line for which you don't need

-USA...

Re: shutdown ports

Bill Hassell — Fri, 05 Dec 2003 13:00:59 GMT

Actually, /etc/services is a documentation file and while some programs that open the listed port will not run if the service is not listed, that's not a guarentee. In Unix, unless there is a program that has opened the port (like inetd or httpd) then the port is closed. Now smtp is usually handled by sendmail so kill the sendmail daemon, then edit /etc/rc.config.d/mailservs to not start sendmail upon reboot. For http, unless you have installed a web server like Apache, then the web ports (8080 1080 80) are closed. To turn off NFS port, make sure the file /etc/rc.config.d/nfsconf has all the services set =0. To stop ports like 512 (rexec) and others, edit /etc/inetd.conf and run inetd -c when you are done.

Re: shutdown ports

A. Clay Stephenson — Fri, 05 Dec 2003 13:05:06 GMT

Actually, editing /etc/services might make you feel better but it really does nothing to enhance security. /etc/services only does portname to portnumber mapping to make things a bit easier for us dumb humans but any intruder software is going to bang on the port using the number. You really have to edit /etc/inetd.conf to disable the services and then tell inetd that you have done it by inetd -c. In a few cases editing inetd.conf is not sufficient because the daemon may be started by an /sbin/rcN.d script --- or may even require a manual start.

Re: shutdown ports

James A. Donovan — Fri, 05 Dec 2003 14:41:12 GMT

I highly recommend reviewing this document.

http://secinf.net/unix_security/Building_a_Bastion_Host_Using_HPUX_11.html

Excellent source of information on ho to secure your HP-UX server.

Re: shutdown ports

Todd McDaniel_1 — Fri, 05 Dec 2003 15:08:48 GMT

in addition to add some more security to your box...

I would highly suggest utilizing /etc/hosts.allow(deny files) similar to what I have done...

This will DISALLOW ALL SERVICES except what you have defined to be available here for remote access... I strongly recommend it...

Here is an additional link I found about config and syntax for hosts.allow/deny.

http://ezine.daemonnews.org/200206/hosts_allow.html

# cat /etc/hosts.allow
#all : all : banners=/usr/localcw/opt/sysguard/banners : allow
ftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
telnetd : all : banners=/usr/localcw/opt/sysguard/banners : allow
tftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
logind : all : banners=/usr/localcw/opt/sysguard/banners : allow
rlogind : all : banners=/usr/localcw/opt/sysguard/banners : allow
remshd: all : banners=/usr/localcw/opt/sysguard/banners : allow
sidftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
rexecd : all : banners=/usr/localcw/opt/sysguard/banners : allow
sshd : all : banners=/usr/localcw/opt/sysguard/banners : allow

# cat /etc/hosts.deny
# Deny all hosts
ALL : ALL

Re: shutdown ports

Karthik S S — Fri, 05 Dec 2003 16:37:09 GMT

HP-UX Security products and functionalities,

http://www.hp.com/products1/unix/operating/security/

http://downloads.securityfocus.com/library/bastion.html

-Karthik S S