topic Re: 11i security in Operating System - HP-UX

11i security

Steve Blackburn_1 — Thu, 24 Jan 2002 01:34:56 GMT

I'm building an 11i server for our DMZ. I want install a minimal OS, however, that option is gone. On the http://www.hp.com/products1/unix/operating/hpux11i/alwayssecure.html page there a link to building a bastion host that tells you to install a minimal OS. It uses 11.00 as an example as says to modify for 11i? I'm guessing I have to install the base and then begin removing filesets? Why is it gone?

Re: 11i security

Steven Sim Kok Leong — Thu, 24 Jan 2002 01:44:38 GMT

Hi,

http://people.hp.se/stevesk/bastion11.html

In addition, use IDS/9000 to perform host-based intrusion detection on your HP-UX 11i.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: 11i security

Michael Tully — Thu, 24 Jan 2002 01:52:18 GMT

One thing to remember when using the bastion document is that just about all of the patches are out of date, and they don't apply to 11i anyway. The document is an excellent example of building a secure system.

-Michael

Re: 11i security

Steve Blackburn_1 — Thu, 24 Jan 2002 01:53:54 GMT

Steven,

Thank you.
This is an excellent document.

My concern is that 11i does NOT have "minimal OS install" as an option. The logical approach is to install the base OS and begin removing filesets. I plan to do just that, it will take longer. Maybe HP has some other option or atleast can explain why the "minimal OS install" is gone.

Re: 11i security

harry d brown jr — Thu, 24 Jan 2002 02:47:14 GMT

Steve,

I recently (7 months ago) replaced about 15 Virtual Vaults with that Bastion paper, but I did it with 11.00. I'll check into it tomorrow, maybe I'll try a fresh install myself to see what I need to adjust in my documentation, and then I'll share it.

live free or die
harry

Re: 11i security

Steven Sim Kok Leong — Thu, 24 Jan 2002 02:54:37 GMT

Hi,

I did a search. Here's some additional information on HP-UX 11i for you:

http://searchhp.techtarget.com/tip/1,289483,sid6_gci776891,00.html

HP-UX 11i also comes with IPFilter/9000 which acts as a host-based firewall. That's in my opinion, excellent.

In addition, HP-UX 11i comes with a kernel parameter to disable execution of stacks (no-exec-stacks) to greatly reduce chances of buffer overflows alike that which has already been available on Solaris 2.6, 8 ages back and most probably in 9.

Hope this helps. Regards.