Security tightening on our HP systems.

[Adam Noble]

We have the following default user accounts on our HP systems:-

daemon
bin
sys
adm
uucp
lp
nuucp
hpdb
www

I assume these accounts are neccesary however do they pose any additional security threats and can we lock them down in any particular way.

Cheers

[Marvin Strong]

Most of those accounts should already be locked by default.

Other security things you might want to look into.

permissions on /tmp /var/tmp /var/preserve
are typically wrong on HP, by being 777 instead of 1777.

comment unused things out of inetd.conf.

and you may also want to add some stuff in nddconf.

[Geoff Wild]

Have a look a Basitlle - it will close down security stuff for you:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

Rgds...Geoff

[Steven E. Protter]

The accounts themselves are not dangerous.

www for example ois for a webserver and you need to be careful with how you run that service.

Bastille is good, because it comes with security_patch_check and requires PERL5 to run.

Bastille's gui makes hardening a system very easy. It also lets you shut down archaic daemons and such. A good start.

SEP

[Ranjith_5]

Hi Adam,


Change the /etc/passwd file for these users as folows.

daemon:*:1:5::/:/usr/bin/false
bin:*:2:2::/usr/bin:/usr/bin/false
sys:*:3:3::/:/usr/bin/false
adm:*:4:4::/var/adm:/usr/bin/false
uucp:*:5:3::/var/spool/uucppublic:/usr/bin/false
lp:*:9:7::/var/spool/lp:/usr/bin/false
nuucp:*:11:11::/var/spool/uucppublic:/usr/bin/false
hpdb:*:27:1:ALLBASE:/:/usr/bin/false
www:*:30:1::/:/usr/bin/false
smbnull:*:101:101:DO NOT USE OR DELETE - needed by Samba:/home/smbnull:/usr/bin/
false
webadmin:*:40:1::/usr/obam/server/nologindir:/usr/bin/false


Regards,
Syam

[Ranjith_5]

Hi Adam,

You can have additional security with bastille hardening tool for HPUX. The documentation on how to achieve this is attached.

I am sure that this will help you in implementing security policies on ur systems.


regards,
Syam