Modifications to /etc/rc.config.d/nddconf

[MAD_2]

Recently I was made aware that there will be a network security inspection done on my system (an RP-5470 with HP-UX 11.00).

I am using as a reference the "Center for Internet Security" (CIS) HP-UX Benchmark v1.0.3 document and tool to find out where there may be some gaps (this can be found here: http://www.cisecurity.org).

I am not very familiar with some of the files for which they recommended changes to be made here, one of these is the nddconf file. The following modifications are advised in the document:

=============================================
5.2 Network parameter Modifications
Action (for HP-UX 11.x systems):
cd /etc/rc.config.d
cp ???p nddconf nddconf.save
cat <> nddconf
TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_forward_src_routed
NDD_VALUE[0]=0
TRANSPORT_NAME[1]=ip
NDD_NAME[1]=ip_forward_directed_broadcasts
NDD_VALUE[1]=0
TRANSPORT_NAME[2]=tcp
NDD_NAME[2]=tcp_conn_request_max
NDD_VALUE[2]=4096
TRANSPORT_NAME[3]=tcp
NDD_NAME[3]=tcp_syn_rcvd_max
NDD_VALUE[3]=4096
TRANSPORT_NAME[4]=tcp
NDD_NAME[4]=tcp_ip_abort_cinterval
NDD_VALUE[4]=60000
TRANSPORT_NAME[5]=ip
NDD_NAME[5]=ip_send_redirects
NDD_VALUE[5]=0
TRANSPORT_NAME[6]=arp
NDD_NAME[6]=arp_cleanup_interval
NDD_VALUE[6]=60000
EOF
chmod go-w,ug-s nddconf nddconf.save

5.3 Disable IP packet forwarding, if possible
Question:
Is this system going to be used as a firewall or gateway to pass network traffic
between different networks?
If the answer to this question is yes, then do not proceed with the actions below.
Action (for HP-UX 11.x systems):
cat <> /etc/rc.config.d/nddconf
TRANSPORT_NAME[8]=ip
NDD_NAME[8]=ip_forwarding
NDD_VALUE[8]=0
EOF

=============================================

Can anyone expand more on these (explain them in a little more of detail) and the impact they will cause on my system? (I attached the document!)

Thanks,

[Anonymous]

ndd -h
gives a SUPPORTED ndd tunable parameters on HP-UX
ndd -h $TUNABLE
gives a oneliner about $TUNABLE

[rick jones]

apart from ndd -h, there is also ftp://ftp.cup.hp.com/dist/networking/briefs/annotated_ndd.txt

which may be of some use. i'm a little surprised they suggest changing the tcp_ip_abort_cinterval and the arp_cleanup_interval, but I suppose the settings they suggest are OK.

[Pheroz Tengra]

I have used the same paper to update my system D250 running Oracle 8.0.5. under 11.0. After rebooting I found my that I was unable to connect internal in Oracle, hence unable to start the database upon power up. At this point I had implemented upto page 26 of the document.

I had to backout a group of changes, in order to get oracle running again.

1) I used my backed to update inetd.conf.
2) I set the /etc/rc.config.d/namesvrs { NAMED=1 }.

I have yet to experiment as to what exactly caused it. This issue is still open in my task list.

[Patrick Wallek]

Just as a side note, you DON'T EVER want to keep backup copies of files in the /etc/rc.config.d directory. If you want a backup of a file in /etc/rc.config.d make sure you put it in a different directory.

The reason for this? When the system boots up, ALL the files in /etc/rc.config.d get sourced. So if you have 2 copies of nddconf, or any other file, you could make changes to one, but the changes could get un-done when the backup of the file is sourced.