topic Re: audit HP server in Operating System - HP-UX

audit HP server

Ferdinand_2 — Thu, 29 Aug 2002 07:37:36 GMT

Hi there,

I have been asked to audit an HP-UX server from a colleague on another project.

What would be a good way to go about this?

I do not want to install anything. I just want to know if the machine performs well and if it is configured correctly (no serious security faults)

The report is mainly for the admin but should also be readable for the 'suits'.

Any tips???

Re: audit HP server

U.SivaKumar_2 — Thu, 29 Aug 2002 07:42:16 GMT

Hi,
Have a look at this link.
http://www.vennerable.com/security.html

regards,
U.SivaKumar

Re: audit HP server

Michael Tully — Thu, 29 Aug 2002 07:49:24 GMT

If you didn't want to install software, there are some basic commmands to use to see that the system is reasonably secure.

Check some file permissions on OS filesystems
find / /opt /usr -xdev -type f -perm 666
find / /opt /usr -xdev -type f -perm 777
find / /opt /usr -xdev -type d -perm 777
The man and cat directories should be ok.
Make sure all mountpoint directories do not have permissions any greater than 755

Check 'root's umask, should 022

You should have 'nosuid' for most, if not all mountpoints (excl. /usr and /opt)
Sticky bit setting for /tmp and /var/tmp

Check where the 'root' home directory is. Should NOT be in /

I don't have a script, but here's a start.
There are a number of tools out there that can be used, especially the document on creating a 'bastion' server and more recently HP-UX bastille.

Re: audit HP server

Alan Casey — Thu, 29 Aug 2002 08:39:39 GMT

Check out the following site:

http://www.auscert.org.au/Information/Auscert_info/Papers/usc20.html

This is the checklist many professional auditors use.

Re: audit HP server

Nick Wickens — Thu, 29 Aug 2002 08:44:36 GMT

Theres also sekchek which I think is a free download from Deloitte Touche Auditors at

http://www.sekchek.com/

These links detail earlier discussions -

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x998e107d277ad611abdb0090277a778c,00.html

http://bizforums.itrc.hp.com/cm/QuestionAnswer/0,,0x3c6d107d277ad611abdb0090277a778c,00.html

Re: audit HP server

Ferdinand_2 — Thu, 29 Aug 2002 09:02:28 GMT

Michael,

I've run that find commando on one of my own machines but what am I seeing here?

btw, it is the thing I am looking for, normal UX commands which will show/ tell me someting.

(mowdb251)/ # find / /opt /usr -xdev -type f -perm 666
/etc/SnmpAgent.d/snmpd.conf
/etc/opt/resmon/persistence/runlevel4_flag
/opt/ifor/ls/res/i4adminX.pdl
/opt/hpnpl/tmp/ljx0003379
/opt/pred/bin/PSERRLOG
/usr/newconfig/var/stm/config/tools/exercise/hosts.cfg
/usr/share/man/cat1.Z/NIS+.1
/usr/share/man/cat1.Z/nis+.1
/usr/share/man/cat1.Z/nis.1
/usr/share/man/cat1.Z/X.1