topic Re: 3rd party security software in Operating System - HP-UX

3rd party security software

Jeff Gyurko — Wed, 25 Jul 2001 12:50:39 GMT

Re: 3rd party security software

Jeff Gyurko — Wed, 25 Jul 2001 12:54:47 GMT

Hey community!

Would help if I type something before grazing the enter key.

I'm looking for opinions/experiences with 3rd party security software on the HP's. Specifically login security, surrogate security, ftp security...the basics. What's worked, what hasn't, what are you currently using, the support you get from the vendor...

Throw it at me.

Thanks all.

Re: 3rd party security software

Chris Calabrese — Wed, 25 Jul 2001 13:03:46 GMT

You should start with the built-in "trusted mode" (/usr/lbin/tsconvert).

As for 3rd party tools, the big ones are Axent/Symantec ESM and Tivoli. But I have to warn you that these are comprehensive security management solutions that assume many machines and dedicated staff.

If you just want to centrally manage user accounts, use NIS+ or LDAP. If you want to harden your systems, see http://www.sabernet.net/papers/hp-ux10.html and http://people.hp.se/stevesk/bastion11.html

Re: 3rd party security software

John Poff — Wed, 25 Jul 2001 13:15:45 GMT

Hi,

We're currently evaluating Nessus here. Nessus does security evaluations on Unix and NT boxes. It seems to hit the box pretty hard. It tripped up on the buggy perflbd that we have which goes runaway when it gets poked. Oops. Gotta load more patches. It is open source, so the price is right. Here is their web site:

http://www.nessus.org

JP

Re: 3rd party security software

Chris Calabrese — Wed, 25 Jul 2001 13:25:36 GMT

That brings up a good point..... Exactly what are you looking for anyway. I was guessing account management, but it's not entirely clear if you want
o account management
o server hardening
o scanners/auditing
o intrusion detection
o forensics
o firewalls

Re: 3rd party security software

Chris Calabrese — Wed, 25 Jul 2001 13:26:56 GMT

Cont...
o remote management (ssh, etc.)
o network encryption (ipsec, etc.)
o file encryption (pgp, etc.).

Re: 3rd party security software

Ralf Hildebrandt — Thu, 26 Jul 2001 09:07:34 GMT

* Replace BIND by BIND-9.x or djbdns
* Replace sendmail by Postfix
* Replace rcp, rlogin, telnet by OpenSSH & friends
* Install TCP_wrappers instead of using inetd.sec

That should help significantly

Then add tripwire or AIDE to have a hostbased IDS

Add snort for a networkbased IDS

And all this AT NO COST!