topic Re: security features in Operating System - HP-UX

security features

khilari — Tue, 27 Dec 2005 13:38:50 GMT

Hi there, actually i just deployed a new hp/ux server. It is in a network and i want to put in security features (firewalls) etc, to make sure it stays secure. Any suggestions as to any patches or software i could install
to achieve that???

Re: security features

Rick Garland — Tue, 27 Dec 2005 14:18:19 GMT

Look into Bastille.

There is an HP port of this product.

Re: security features

Steven E. Protter — Tue, 27 Dec 2005 14:49:29 GMT

Shalom Mujtaba,

Bastille is a good start.
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA
It requires Perl 5

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=PERL

There are several options to be aware of with Bastille.

1) It can shut down vulnerable, little used deamons that one wonders why are installed in the first place. This also boosts system peformrance.
2) You can automatically set up security_patch_check and have your systems checked against the lastest required security patches from HP. This is actually a requirement in many service contracts and should not be ignored.

3) You can set up the ipfilter firewall and have a firewall directly on your HP server. This is probably better done with a hardware solution, but if there is no hardware solution or Linux box around, this will do.

If you use Bastille to disable the Berkley protocols, this may interfere with Serviceguard and will interfere with Ignite, DR, so tread cautiously.

Security is a never ending job of searchs and tweaks and sofware upgrades.

You might also find a commercial product, Tripwire useful for you security. It makes sure binaries are not altered my malicoius users and such.

SEP

Re: security features

wip — Wed, 28 Dec 2005 01:22:49 GMT

Hi,

Please try Internet System Scanner from ISS and do a security base line by scanning you entire system for security vulnerabilities for hpux.

thanks
wip

Re: security features

Andrew Cowan — Wed, 28 Dec 2005 04:29:41 GMT

The Nessus security scanner is also a good tool to scan for vulnerabilities. See: http://www.nessus.org/