topic Re: Disable some daemons on a secure HP-UX server in Operating System - HP-UX

Disable some daemons on a secure HP-UX server

kaushikbr — Tue, 17 Apr 2007 04:35:46 GMT

Hi,

For security reasons we have to disable the following daemons or services on a HP-UX B11.23 IA server. What is the best way to do it ?
Thanks and regards
For all you suggestions.

Kaushik

Services/Daemons to be disabled :
bootps
tftp
ftpd
finger
shell
login
rusersd
walld
exec
talk
chargen
comsat
daytime
discard
rexd
sprayd
echo
rlogind
remshd

Re: Disable some daemons on a secure HP-UX server

network_4 — Tue, 17 Apr 2007 04:40:25 GMT

Rename the binaries of respective services

Re: Disable some daemons on a secure HP-UX server

VK2COT — Tue, 17 Apr 2007 04:50:51 GMT

Hello,

There are couple of ways.

a) Use Bastille to automate it for you;

b) Edit /etc/inetd.conf and comment
out all of the protocols you listed above.

Then, restart the server or inetd itself...

c) Then, use some audit method to check
the server configuration.

If you trust me, you can use a Perl script
that runs over 200 tests (and now includes
support for HP-UX 11.31 as well):

http://www.circlingcycle.com.au/Unix-sources/HP-UX-check-OAT.pl.txt

It helps me a lot on many servers I work on
for customers every day :)

Of course, there are many other scripts around...

VK2COT

Re: Disable some daemons on a secure HP-UX server

Steven E. Protter — Tue, 17 Apr 2007 05:38:51 GMT

Shalom,

>>
Rename the binaries of respective services
>>

No, this will cause errors and problems.

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

Requires:
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=PERL

Note you can manualy disable many of these services in inetd.conf

SEP

Re: Disable some daemons on a secure HP-UX server

kaushikbr — Tue, 17 Apr 2007 06:51:52 GMT

Hi,

Thank you all for your replies.

I was not aware of "bastille", this is a wonderful tool. I find it very useful for a novice administrator such as myself. However I was not sure ( before starting this thread )that disabling these daemons / services from the inetd.conf was the way to go forward. Thank you all for your very useful suggestions.

Regards
Kaushik