topic Re: Services Security in Operating System - HP-UX

Services Security

Pedro Tapia_2 — Sun, 31 Jul 2005 19:29:23 GMT

In order to optimize the security in my server HP-UX who ports and services disable ???. Thank you very much

Re: Services Security

generic_1 — Mon, 01 Aug 2005 01:53:14 GMT

If you posted what applications and versions you run you might get a more exact answer. If you get too crazy with it you could break applications or parts of the OS.

Re: Services Security

Alessandro Pilati — Mon, 01 Aug 2005 02:19:38 GMT

Hi Pedro,
take a look on this:

http://sabernet.home.comcast.net/papers/hp-ux10.html#1.0

For more specific details tell us some more specific information about your system and its functionalities.

Rgds,
Alex

Re: Services Security

Ralph Grothe — Mon, 01 Aug 2005 02:25:52 GMT

Hi Pedro,

it depends on the purpose of your host.

There's been quite a good document about hardening a HP-UX 11 host like for a DMZ bastion host reappearing on various websites.

Here is one of those links:

http://www.unixadm.net/hp/bastioning_hpux.11.html

You may get some ideas of what could be done to increase services' security.

Also you could try the program Bastille which I read about will aid in hardening.
It even might be on the HP's Internet Express.

You could also run checks from a Nessus server against your host.
Nessus has tons of plug-ins for all kinds of security checks.
And if your still dissatesfied it has an own interpreter with syntax close to C that would enable you to write your own check plug-ins.

Re: Services Security

Ralph Grothe — Mon, 01 Aug 2005 02:36:25 GMT

Addendum,
HP already have included Bastille in their toolbox as I found out here

http://docs.hp.com/en/5990-6737/ch07s06.html

and they also included Nessus in their Internet Express

http://docs.hp.com/en/5990-8580/ch01s02.html

Re: Services Security

Pedro Tapia_2 — Mon, 01 Aug 2005 12:02:09 GMT

First that nothing, thank you very much by the attention and its answers. The server is rp7410 with HP-UX 11.11 and IBM Informix 7.31 FD8 as database engine. This server this within my LAN and supports to applications Client/Server and WEB. The users in a 95% connect via ODBC
Thanks

Re: Services Security

Robert Fritz — Mon, 01 Aug 2005 16:13:13 GMT

If I could make a further pith for Bastille.

It comes with 11.23 and up, but is free to download for 11.00 and 11.11;
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

I think it does exactly what you're asking for (disabling services), it is more recent than the Bastion host whitepaper, has an easy-to-use, educational GUI, and can even help you set up a host-based firewall (with IPFilter) to allow you do specify which ports you *want* exposed to the net vs. the other way around. It has ~79 things it does total, including the services disablement you mention.

(can you tell I'm on the Bastille team :-) )

Anyway, let me know if the tool doesn't meet your needs. We're always interested in feedback.