topic Services Running in Operating System - HP-UX

Services Running

Nancy Verkamp — Tue, 31 Jul 2001 11:00:07 GMT

We are wanting to secure our HPUX (10.20 and 11.0) by stopping services that are not/should not be used. Is there a resource to assist us with this? Has anyone else done this recently that can suggest a method that worked for them?

Re: Services Running

Rainer von Bongartz — Tue, 31 Jul 2001 11:25:56 GMT

Try this ressources:

http://people.hp.se/stevesk/bastion11.html
http://people.hp.se/stevesk/bastion10.html
http://secinf.net/info/unix/secureHP-UX.html

Re: Services Running

James R. Ferguson — Tue, 31 Jul 2001 11:30:38 GMT

Hi Nancy:

You can comment-out the services you do not need in /etc/inetd.conf (e.g. 'echo, 'chargen', etc.) and restart the 'inetd' daemon:

# /usr/sbin/inetd -c

...JRF...

Re: Services Running

Ravi_8 — Tue, 31 Jul 2001 11:38:08 GMT

Hi,
inetd is the process that supervises the internet.
if you don't want any kind of activities in your system comment all the RPC lines in /etc/inetd.conf file. excecute the command 'inetd -c' , this will stop all RPC processes and kill the inetd process.

Re: Services Running

Harinath N — Wed, 01 Aug 2001 01:29:05 GMT

Hi Nancy,

To secure your system, you can comment the required ARPA/Berkeley services (telnet, ftp, rlogin, etc.) in /etc/inetd.conf file.
Incase if you want allow these services for some particular users, then you can enable security level for inet services using /var/adm/inetd.sec file(refer man page for inetd.sec entry). Any changes performed in /etc/inetd.conf file can be brought into effect by using "inetd -c" command, which will reconfigure the Internet daemon by rereading the config. file once again.

Further security of your system can be acheived by ensuring proper file permissions(recommended : 644 and in some case 664).

Hope this will help a bit.

Regards,
N.Harinath.

Re: Services Running

Thomas D. Harrison — Wed, 01 Aug 2001 18:55:24 GMT

Nancy,

I'm looking into the same issue myself. I'd recommend the following methodology.

1) Turn on as much logging as you can. This would include modifying syslog.conf. Also do a man on the various daemons to see if there are log options available. (e.g. ftpd has logging options.)

2) After a "suitable" period of time, view these logs.
It might be helpful in the case of /var/adm/syslog/syslog.log to do the following:

cat /var/adm/syslog/syslog.log | grep rpcbind > rpcbind.log
cat /var/adm/syslog/syslog.log | grep LVM > LVM.log
etc...

3) Upon implementation, I would recommend having some tests clearly defined in advance, as well as having the fall back clearly planned.

I wish I could be more help but this is the first time
I'm doing this as well.

Good Luck and let us know if you run across any Einstein-ish ideas as you work on it!