HP UX security checklist?

[SandiC]

Recently we are getting a lot of bad login attempts. Lastb reveals foreign ips that are attempting to guess login ids.

What is the best way to start locking down our system? Does anyone have a security guidleine checklist and an idea of how to block these without changing our ip and creating a vpn? We are hp ux 11.11 64 trusted sys setup.

tia,
Sandi

[Steven E. Protter · Accepted solution]

Shalom,

I assume your system is exposed in some way to the Internet.

Checklist:
1) If possible use a firewall to limit from where login. If you can limit the networks permitted to log in, you can drastically reduce the scope of this problem.
2) Consider using tcp wrappers (free from http://software.hp.com) to limit logins more smoothly.
3) If these are ssh login attempts, change the root login in sshd_config to only key based logins. This will make root access attempts useless because to login as root you will need to first place a public key on the system. Creates a good chicken or egg situation for you.
4) Use Bastille (http://software.hp.com) to harden your system and stop running services that are not needed.
5) Stop using telnet and ftp, use ssh and sftp. The latter two encrypt the data stream and authentication, which makes it less likely that you will be hacked.
6) Stop using r protocols in inetd.conf. Transfer rate will drop due to the data stream being encrypted, as will authentication speed.
7) Tighten file permissions in general. World writeable is bad.
8) Tighten umask for users. Make files less vulnerable.
9) Make sure you run security_patch_check (Bastille) and install all needed security patches.
10) I did create a daemon that shuts down ip addresses that have too many bad logins but it created a very long firewall block list. I can try and dig it up if you want.

This list is not complete but is a good start.

SEP

[Juan M Leon]

I will encourage to use tcp wrapper like Steve suggested.
This way you can always update the allow/deny file with the IP address that you want to allow access, anybody else will not be prompted for password.
This way you will reduce the amount of alerts in your file.

[spex]

Sandi,

Steven has provided an excellent checklist. As he recommends, the first line of defense is a good firewall.

PCS

[SandiC]

Thank you so much. Am not familiar with Bastille, but sounds like a good place to go.
Sandi

[Pierre Pasturel]

Sorry for the shameless plug .... :)

But also consider HPUX Host IDS for monitoring such things as the creation of world-writable files, creation of privileged setuid/setgid executables, and modification of critical files.

The latest release is V4.1. You can find the product web page at http://h20338.www2.hp.com/hpux11i/cache/324806-0-0-225-121.html

Pierre

[SandiC]

Thank you all!
I'm downloading the TCP wrapper right now.
SO it would allow me to in effect block all but known ips? The bad attempts appear to be coming from servers that I suspect change their addresses often.

[Steven E. Protter]

Shalom,

Yes with tcp_wrappers you can limit the networks from which login is permitted, any protocol.

SEP

[Steven E. Protter]

Shalom,

Yes with tcp_wrappers you can limit the networks from which login is permitted, any protocol.

http://www.linux.com/feature/61061?theme=print
This is a linux link but tcp wrappers works the same way on hpux. Also good docs on docs.hp.com

HIDS is probably overkill and can likely use up all your processing power. Used in a limited way you could use it to detect and define malicious activity. You however have already identified the problem, script kiddie login guesses.

11) On my list. Insure all non-system users have complex passwords.

SEP

[Pierre Pasturel]

Steven wrote:
"HIDS ... can likely use up all your processing power."

We did deliver significant performance improvements in Dec 2004 starting with HIDS v3.0. The impact of HIDS on CPU and memory usage depends on:
1) The HIDS configuration: what you tell it to monitor and how well you have tuned HIDS to filter unwanted alerts. We delivered a centrally managed tuning tool recently with HIDS v4.1 to facilitate collecting, reporting, and filtering unwanted alerts.
2) The system load profile: specifically, the rate at which your applications & system generate the kernel system call audit records that HIDS processes for doing detection. For details, please refer to the HIDS tuning/sizing paper that is available from docs.hp.com (follow the documentation link provided at the HIDS product web page).

Pierre