HP UX security checklist?

[Keith Buck]

A few additional thoughts:

1. Bastille will help you setup a basic ipfilter firewall (if you install ipfilter). The basic setup allows all outgoing traffic (and stateful return) but blocks all the incoming ports except the ones you allow. Bastille is intended to be the checklist you are looking for; we took into account several other checklists and chose what we felt were the most important things to focus on and implemented those first. Bastille is now in its 3rd generation and although there are things we'd like to add, it should be a fairly comprehensive start. On 11.23/11.31, you can even select a "one-click" Bastille hardening level at install-time (although going through the GUI is intended to be very educational too)

2. Software Assistant is replacing Security Patch Check. It includes much improved reporting and automatic downloads, integrity checking, and depot creation for patches. You can get it at https://www.hp.com/go/swa
Bastille can setup a cron job to run a report nightly.

Hope that helps.

-Keith

[Robert Fritz]

I'd recommend IPfilter over TCP Wrappers for control and performance. IPFilter is built into the Kernel and comes standard with the OE, so it is tuned to work with the HP-UX Network stack with negligible performance degradation, unlike TCP Wrappers. It is fully supported, and free. It allows more control than tcp wrappers. In addition it provides better UDP/ICMP support, support for multiple layer-2 stacks, handy configuration and rule-testing programs, and neat features like connection-allocation. In addition, Bastille can give you a handy "starter" firewall as Keith mentioned with little work... just the use of an install time security level (in Ignite), or a run through the Bastille security-wizard.

[SandiC]

Thank you! now at least I have more options!

[SandiC]

Starting with Bastile to see what is recommended. Thanks to everyone!

Sandi