topic Re: Emergency Help in Operating System - HP-UX

Emergency Help

Nobody's Hero — Tue, 16 Nov 2004 10:24:28 GMT

We are getting hammered with outbound request to the internet, maybe a worm or virus, spyware. I dont know. So we are putting a cisco pix in place. Question. Is there a content filter for Unix that I can run as a Unix firewall and replace our windoze firewall? Is there a free product I can download now to get our business running. Right now our business is diving due to a flux of traffic that interrupts internet access.

Also, anyone heard of a new virus that is picking on port 445?

Re: Emergency Help

RAC_1 — Tue, 16 Nov 2004 10:29:40 GMT

Port 445 is the port apache uses for ssh (In most cases and by default) If you do not need apache (process -http), you can just shut it down. Also you can check which process is using port 445.

lsof -p tcp:445
lsof -p udp:445

lsof - is a tool (list open files. Get it from http://hpux.connect.org.uk)

you can also do
netstat -an|grep 445 and see which process is using port 445 and if not required you can stop process.

For content filter you can use free hp-ux product - ipfilter. Look for it at product.hp.com

Hope this helps.

Anil

Re: Emergency Help

Sanjay_6 — Tue, 16 Nov 2004 10:31:16 GMT

Hi Robert,

You can look into ipfilter,

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B9901AA

Hope this helps.

Regds

Re: Emergency Help

Fred Ruffet — Tue, 16 Nov 2004 10:38:26 GMT

You can install a linux box to be used as a firewall. It has iptables built-in, wich can be configured as a good protection. You may find GUI to configure it or even other products for Linux FW.

To secure your HP-UX Box, you can try Bastille (download on http://software.hp.com/) which is also available for linux.

Regards,

Fred

Re: Emergency Help

Steven E. Protter — Tue, 16 Nov 2004 10:40:30 GMT

The ipfilter firewall can protect your Unix/HP-UX machine in the following ways:

It can totally block specific ports. It can block certain protcols on ports you need to leave open.

If you identify the port the bad traffic is on, configuration is relatively easy.

I'm attaching my ipf.conf file from a sandbox machine that was getting hammered until i brought up ipfilter. I believe there is already a link to that product in this thread.

SEP

Re: Emergency Help

Sanjay_6 — Tue, 16 Nov 2004 10:45:20 GMT

Hi Robert,

check the symantec site for the latest virus threat.

http://securityresponse.symantec.com/avcenter/vinfodb.html

Hope this helps.

regds