topic Re: Security Products on HP-UX in Operating System - HP-UX

Security Products on HP-UX

Swetha — Thu, 06 May 2004 02:23:43 GMT

Hi,

I need info on how/why HP-UX is a better OS compared to AIX, Solaris etc, especially in the security space.

I have seen a couple of whitepapers about the security offerings on HP-UX but none containing a competitive analysis.

Any pointers would be of great help.

Regards,
Swetha.

Re: Security Products on HP-UX

generic_1 — Thu, 06 May 2004 02:37:30 GMT

I think HP is pretty good at alerting Customers on Security patches.

Also this thread might be interesting to you:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=426710

Re: Security Products on HP-UX

Robert-Jan Goossens — Thu, 06 May 2004 02:43:22 GMT

Hi,

Below you find some security products. Docs can be found at http://www.docs.hp.com/hpux/internet/index.html

HP Bastille
http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

Secure Shell
http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

More,
http://www.software.hp.com/portal/swdepot/displayProductsList.do?category=ISS

Hope this helps,
Robert-Jan

Re: Security Products on HP-UX

Joseph Loo — Thu, 06 May 2004 02:50:14 GMT

hi,

are you asking about how secure the platform, HP-UX compares against the other platform, e.g. AIX, Solaris, LINUX?

regards.

Re: Security Products on HP-UX

Steven E. Protter — Thu, 06 May 2004 02:54:08 GMT

Intrusion Detection:
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=J5083AA

IpSec
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=J4256AA

Security Patch Check(comes with Bastille)
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6834AA

Strong really random number generator
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=KRNG11I

Don't forget two education offerings:

Practical Network & Unix SEcurity

Internet Security

SEP

Re: Security Products on HP-UX

Stefan Farrelly — Thu, 06 May 2004 03:14:00 GMT

Take a look at this;

http://www.boran.com/security/it15-os-overview.html

This has a nice summary of security levels (eg, c1, c2, b1 and b2 - in increasing order of more secure) against which OS can do them. Then you need to investigate which level SunOS, AIX and HPUX can do. Basically all can do C2, Sun and HP have a variant which can do the much more secure B1, cant see AIX on there (above C2).

Cheers,

Stefan

Re: Security Products on HP-UX

V.Tamilvanan — Thu, 06 May 2004 03:15:37 GMT

Hi,

This link may help you.

http://www.hp.com/products1/unix/operating/security/index.html#hpux11i_system

Re: Security Products on HP-UX

Stefan Farrelly — Thu, 06 May 2004 03:22:31 GMT

Further to my last reply the source document for this was;

NSA (National Security Agency)
document: Information Systems Security: Product and Services Catalog

But the one I posted is old - 1995. There is surely updated versions but you must purchase them from the NSA (thats why theyre not freely available on the web) - theyre cheap though. Check it out here;

http://www.boran.com/security/nsapubs.txt

Unless someone has an updated version they can post here ?

Obviously this sort of Unix security comparison requries a lot of work thats why the NSA charge for the results.

Re: Security Products on HP-UX

John Diamant — Thu, 06 May 2004 16:22:15 GMT

How about this for a competitive analysis?
http://h71028.www7.hp.com/enterprise/downloads/unix_ranking.pdf
and
http://whitepapers.zdnet.co.uk/0,39025945,60044220p-39000571q,00.htm

DH Brown evaluated OSes including Solaris, AIX, and HP-UX against 5 categories, including Security Services, and gave HP-UX top scores in all categories.

The report's a bit dated, but I believe it's DH Brown's most recent UNIX Function review.

HP-UX has added a number of security features since that evaluation, further strengthening our offering (Security Patch Check, Bastille, Install Time Security, executable stack protection and more were added after the DH Brown evaluation, and many other security features were enhanced since then as well, including even more LDAP integration, improvements to IPFilter and Host Intrusion Detection and others mentioned in the HP URLs listed in earlier messages).

John

Re: Security Products on HP-UX

Colin Topliss — Thu, 06 May 2004 17:58:40 GMT

TCP wrappers is also available.

But, on the downside (sorry):

C2 is a great idea, but not that many applications support it. System calls to get/set the password entry change from getpwent to getprpwent - not many applications take this into account, and so fail authentication. Caution is advised.

By default, there is no shadow password file, so it is possible to extract the encoded passwords. This is a *real* pain. HP did bring this functionality out as a patch, but last time I looked at it it didn't support NIS (cringe) or LDAP. Again, a bit of a pain if you use those services.

IDS is sort of OK, but I personally found it a bit cumbersome, and the more systems you had the more cumbersome it became to try and keep on top of it all. There are other alternatives to system monitoring out there (tripwire, Axent ESM etc etc) that may be more useful.

Some of the default ndd settings are a little odd, and need to be modified to circumvent not only malicious attacks but mis-behaving applications too.

Any system, when it comes to security, is only as good as its configuration. Some of the extra tools can be dangerous to your security if you are not careful (ie sudo - great to log who does what as root rather than log in as root themselves, but a slight mis-configuration can grant anyone root access without a password).

Re: Security Products on HP-UX

Berlene Herren — Fri, 07 May 2004 05:23:37 GMT

Here is a whitepaper from SANS that lists "UNIX System Management and Security: Differences between Linux, Solaris, AIX and HP-UX." Dated Feb 2003

http://www.sans.org/rr/papers/index.php?id=936

Berlene

Re: Security Products on HP-UX

Fabio Ettore — Fri, 07 May 2004 05:28:06 GMT

Hi Swetha,

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5187-2216/5187-2216_top.html&con=/hpux/onlinedocs/5187-2216/00/00/65-con.html&toc=/hpux/onlinedocs/5187-2216/00/00/65-toc.html&searchterms=security&queryid=20040507-042616

docs.hp.com is the best site for all HP-UX documentation.
I gave you only a link but that can be a point of start.

HTH.

Best regards,
Ettore

Re: Security Products on HP-UX

Ted Buis — Fri, 07 May 2004 16:11:06 GMT

D.H. Brown rated HP-UX #1 overall and specifically in security in 2002 (actually #1 in all categories, with one tied with Tru64), and I think the primary reason for #1 in security was IPfilter/9000 and IDS/9000 being bundled into the OS in 11i. Competitors didn't have those features bundled into their OS release.

Re: Security Products on HP-UX

Vrinda Vasudevan — Mon, 24 May 2004 06:16:01 GMT

Hi Swetha,

In addition, we now have the Kerberos server v3.1 with LDAP as the backend server. For more info, do lookup docs.hp.com.

-Vrinda

Re: Security Products on HP-UX

R. Sri Ram Kishore_1 — Thu, 03 Jun 2004 03:37:16 GMT

Hi Swetha,

Please refer to
http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5187-2216/5187-2216_top.html&con=/hpux/onlinedocs/5187-2216/00/00/62-con.html&toc=/hpux/onlinedocs/5187-2216/00/00/62-toc.html&searchterms=security%7cwhitepaper%7csystem&queryid=20040603-023324.

HTH,
Sri Ram

Re: Security Products on HP-UX

R. Sri Ram Kishore_1 — Thu, 03 Jun 2004 03:44:01 GMT

Hi Swetha,

You might also want to refer to the book, "HP-UX 11i Security", by Chris Wong.

Regards,
Sri Ram