topic Re: system hardening in Operating System - HP-UX

system hardening

Golf_4_Me — Mon, 01 Aug 2011 20:20:13 GMT

Hi All,

I am new to this board and look to the group for some guidance. I have been tasked with doing some server hardening for our HP-UX 11.x PA/IA machines. I've read everything I've found on the subject but most docs seem to be pretty outdated. I am familiar with Bastille and creating Trusted systems but at this point I would like to start by shutting down unnecessary services and ports.

Can anyone point me to documentation/information about HP-UX 11.x default installed services and their purposes?

I know many services can be turned off with the /etc/rc.config.d/* scripts but regarding /sbin/rc*.d links, is changing the capital K or S to lower case sufficient to shut off the service? In other words, will lower case first characters cause the link to be ignored?

Thank you in advance, any guidance is greatly appreciated.

Best regards,

PDY

Re: system hardening

Dennis Handly — Mon, 01 Aug 2011 20:35:23 GMT

>I know many services can be turned off with the /etc/rc.config.d/* scripts

That's what you should first use.

>but regarding /sbin/rc*.d links, is changing the capital K or S to lower case sufficient to shut off the service?

It might work. But better to remove them or move them elsewhere.

You should also look at inetd(1M) and inetd.conf(4).

Re: system hardening

Doug O'Leary — Tue, 02 Aug 2011 12:46:09 GMT

Hey;

>>I know many services can be turned off with the /etc/rc.config.d/* scripts but regarding /sbin/rc*.d links, is changing the capital K or S to lower case sufficient to shut off the service? In other words, will lower case first characters cause the link to be ignored?

Yes, the lower case characters 'will cause the links ot be ignored'. If you look at the rc script itself, on/about line 17 of /sbin/rc, is a function called get_scripts. The logic is a fairly easy to folllow if you're familiar with scripting; however, the key part for this discussion is:

case $name in

${mode}*)

${mode} will either be 'S' or 'K'

So, moving the link to a lower case will eliminate it from consideration which is also in line with the standard method on other OSs.

All that being said, if there is an /etc/rc.config.d script, edit that. Some apps don't use those, though, so you should be aware of this method as well.

Hope that helps.

Doug O'Leary

Re: system hardening

Golf_4_Me — Tue, 02 Aug 2011 15:38:58 GMT

Hi,

Thank you for the replies, they are very helpful.

Does anyone know of a source that describes the default HP-UX /etc/rc.config.d/* services and their use/purpose? I am currently researching to find information on each but if there is a doc on the subject it would be a great help.

Thanks in advance,

PDY

Re: system hardening

Dennis Handly — Wed, 03 Aug 2011 07:54:16 GMT

>Does anyone know of a source that describes the default HP-UX /etc/rc.config.d/* services and their use/purpose?

You could ask each init script to print its purpose:

$ /sbin/init.d/nfs.client start_msg
Start NFS client subsystem