system hardening

[Golf_4_Me]

Hi All,

I am new to this board and look to the group for some guidance. I have been tasked with doing some server hardening for our HP-UX 11.x PA/IA machines. I've read everything I've found on the subject but most docs seem to be pretty outdated. I am familiar with Bastille and creating Trusted systems but at this point I would like to start by shutting down unnecessary services and ports.

Can anyone point me to documentation/information about HP-UX 11.x default installed services and their purposes?

I know many services can be turned off with the /etc/rc.config.d/* scripts but regarding /sbin/rc*.d links, is changing the capital K or S to lower case sufficient to shut off the service? In other words, will lower case first characters cause the link to be ignored?

Thank you in advance, any guidance is greatly appreciated.

Best regards,

PDY

[Dennis Handly]

>I know many services can be turned off with the /etc/rc.config.d/* scripts

That's what you should first use.

>but regarding /sbin/rc*.d links, is changing the capital K or S to lower case sufficient to shut off the service?

It might work.  But better to remove them or move them elsewhere.

You should also look at inetd(1M) and inetd.conf(4).

[Doug O'Leary]

Hey;

>>I know many services can be turned off with the /etc/rc.config.d/* scripts but regarding /sbin/rc*.d links, is changing the capital K or S to lower case sufficient to shut off the service? In other words, will lower case first characters cause the link to be ignored?

Yes, the lower case characters 'will cause the links ot be ignored'.  If you look at the rc script itself, on/about line 17 of /sbin/rc, is a function called get_scripts.  The logic is a fairly easy to folllow if you're familiar with scripting; however, the key part for this discussion is: 

case $name in 

${mode}*)

${mode} will either be 'S' or 'K' 

So, moving the link to a lower case will eliminate it from consideration which is also in line with the standard method on other OSs.

All that being said, if there is an /etc/rc.config.d script, edit that.  Some apps don't use those, though, so you should be aware of this method as well.

Hope that helps.

Doug O'Leary

[Golf_4_Me]

Hi,

Thank you for the replies, they are very helpful.

Does anyone know of a source that describes the default HP-UX /etc/rc.config.d/* services and their use/purpose?  I am currently researching to find information on each but if there is a doc on the subject it would be a great help.

Thanks in advance,

PDY

[Dennis Handly]

>Does anyone know of a source that describes the default HP-UX /etc/rc.config.d/* services and their use/purpose?

You could ask each init script to print its purpose:

$ /sbin/init.d/nfs.client start_msg
Start NFS client subsystem