topic Re: ntp/external in Operating System - HP-UX

ntp/external

Nobody's Hero — Wed, 10 Dec 2003 08:31:11 GMT

I recently punched a hole through the firewall so my HPUX time server could get to the outside world for a valid time source, all is well. Question, are there any process I should shut down on this HPUX box to prevent intrusion? I am a little worried about an outsider coming in on one of my services.

Re: ntp/external

Hazem Mahmoud_3 — Wed, 10 Dec 2003 08:34:19 GMT

Generally the rule is if you don't need it then turn it off. Go to /etc/services and comment out ("#") any lines. Also check the /etc/inetd.conf file and remove any services that you do not need. If the only purpose of this HPUX server is to function as a time server than you can get rid of a whole lot.

-Hazem

Re: ntp/external

Michael Schulte zur Sur — Wed, 10 Dec 2003 08:42:21 GMT

Hi,

it depends on how big the hole is, you punched into the firewall. ;-) You only need a hole the size of the port that is needed for ntp, or am I wrong?

be careful,

Michael

Re: ntp/external

Bill Hassell — Wed, 10 Dec 2003 08:44:49 GMT

The NTP port (123) is considered to be safe. If your firewall has just one port open, then the rest of the services can't be seen or reached from outside the firewall (assuming you have a good firewall and a good administrator). But good security demands that all ports be closed by default and then an explicit decision to run a service (open a port) made based on corporate guidelines. Most security problems come from inside the firewall.

Re: ntp/external

RAC_1 — Wed, 10 Dec 2003 08:45:05 GMT

You can close the services that you do not want. (Check /etc/services and /etc/inetd.conf)

A tool like nmap can give you idea on what ports are open on ur server.

Re: ntp/external

Steven E. Protter — Wed, 10 Dec 2003 10:44:50 GMT

A agree with Bill Hassell. Port 123 is safe.

My employer disagrees with that, so they have the firewall act as a time server and ntp must be configured to take time off of that port.

If you are worried and don't trust your firewall, ipfilter can be installed on the hp box and configured to allow only one way traffic on port 123. Your machine will be able to go out and get the time but nothing will be able to come in on 123.

I can probably dig up a configuration for you if you are interested.

SEP