topic Re: Security Level Associated with Traditional HPUX installation in Operating System - HP-UX

Security Level Associated with Traditional HPUX installation

Abdul Salam H S_1 — Tue, 28 May 2002 12:02:38 GMT

Hi,

Can someone tell me what is the security level associated with Traditional HP UX installation? Is there any utility for assessing the security levels of HPUX systems?
With trusted system, the level is known as C2 level.Is there any level or standard like this for normal HPUX installation?

Thanks and Regds,

Abdul Salam

Re: Security Level Associated with Traditional HPUX installation

Sebastian Galeski_1 — Tue, 28 May 2002 12:10:58 GMT

Standard UNIX is C1

Re: Security Level Associated with Traditional HPUX installation

Stefan Farrelly — Tue, 28 May 2002 12:14:59 GMT

I dont think there is any security level associated with a default HP-UX installation. Its basically not very secure at all.

If you convert to a trusted system it does NOT make your server C2 security compliant. All youve done is adopt part of the C2 security requirements - only those for password control. A truly C2 compliant server would have encrypted network connections and lots of other goodies (ssh, nfs over ssh etc.)

Re: Security Level Associated with Traditional HPUX installation

Bill Hassell — Tue, 28 May 2002 12:18:25 GMT

Most security experts would define a cold install of HP-UX as un-secure. There are several missing features (like umask), almost every service is turned on by default and many directories and files have open permissions. These will not be fixed by converting to C2 (Trusted). You still need to shutdown the majority of network services and ideally install IDS/9000 (for 11.0 and higher). Also get a copy of the book "HP-UX 11i Security" by Chris Wong.

Re: Security Level Associated with Traditional HPUX installation

Steven Sim Kok Leong — Tue, 28 May 2002 13:05:56 GMT

Hi,

Center for Internet Security has a level 1 (not TCSEC) security benchmark for HP-UX 10.20, 11.00 and 11.11:

http://www.cisecurity.org/bench_HPUX.html

To comply with TCSEC Orange Book C2 security, you need to convert your server to trusted (TCB).

To comply to TCSEC B-level security, you should be looking at HP's VirtualVault.

"Virtualvault trusted Web server platform is built upon a trusted operating system that incorporates tough B-level Department of Defense Trusted Computer System Standards (TCSEC) features."

http://www.hp.com/security/products/virtualvault/papers/brief_4.0/

Hope this helps. Regards.

Steven Sim Kok Leong

Re: Security Level Associated with Traditional HPUX installation

Wodisch — Tue, 28 May 2002 17:02:22 GMT

Salam,

actually as long as HP-UX stores the (encrypted) passwords visible for everybody in "/etc/passwd" it belongs to the TCSEC category "D" (="minimal security", read: none!)!
For that reason do so many other vendors make use of the not-public-readable "/etc/shadow" store for passwords...

Just my $0.02,
Wodisch

Re: Security Level Associated with Traditional HPUX installation

Steven Sim Kok Leong — Tue, 28 May 2002 22:07:45 GMT

Hi,

Standard HP-UX is not at TCSEC level D. It is at TCSEC level C1 because it complies with security features such as "Identification and Authentication" as well as "Discretionary Access Controls" etc.

An example of an OS at TCSEC level D is MS-DOS i.e. it is an OS with no knowledge of "user identity" and "access control" etc.

Btw, the following is an excellent whitepaper on the security differences between standard and trusted HP-UX:

http://www.hp.com/products1/unix/operating/infolibrary/whitepapers/sec9906.pdf

Some of the B1 special releases include HP-UX 10.09 and 10.16 etc.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: Security Level Associated with Traditional HPUX installation

Glenn L. Stewart — Wed, 29 May 2002 12:14:25 GMT

Hi,

The easiest variation from vanilla HP-UX is of course the move to trusted system.

But many more changes may be made to ensure a greater security.

This document clearly highlights obvious changes.
http://www.hp.com/products1/unix/operating/infolibrary/whitepapers/building_a_bastion_host.pdf
Excellent read!

Glenn