3rd party security software

[Jeff Gyurko]

Hey community!

Would help if I type something before grazing the enter key.

I'm looking for opinions/experiences with 3rd party security software on the HP's. Specifically login security, surrogate security, ftp security...the basics. What's worked, what hasn't, what are you currently using, the support you get from the vendor...

Throw it at me.

Thanks all.

[Chris Calabrese · Accepted solution]

You should start with the built-in "trusted mode" (/usr/lbin/tsconvert).

As for 3rd party tools, the big ones are Axent/Symantec ESM and Tivoli. But I have to warn you that these are comprehensive security management solutions that assume many machines and dedicated staff.

If you just want to centrally manage user accounts, use NIS+ or LDAP. If you want to harden your systems, see http://www.sabernet.net/papers/hp-ux10.html and http://people.hp.se/stevesk/bastion11.html

[John Poff]

Hi,

We're currently evaluating Nessus here. Nessus does security evaluations on Unix and NT boxes. It seems to hit the box pretty hard. It tripped up on the buggy perflbd that we have which goes runaway when it gets poked. Oops. Gotta load more patches. It is open source, so the price is right. Here is their web site:

http://www.nessus.org


JP

[Chris Calabrese]

That brings up a good point..... Exactly what are you looking for anyway. I was guessing account management, but it's not entirely clear if you want
o account management
o server hardening
o scanners/auditing
o intrusion detection
o forensics
o firewalls

[Chris Calabrese]

Cont...
o remote management (ssh, etc.)
o network encryption (ipsec, etc.)
o file encryption (pgp, etc.).

[Ralf Hildebrandt]

* Replace BIND by BIND-9.x or djbdns
* Replace sendmail by Postfix
* Replace rcp, rlogin, telnet by OpenSSH & friends
* Install TCP_wrappers instead of using inetd.sec

That should help significantly

Then add tripwire or AIDE to have a hostbased IDS

Add snort for a networkbased IDS

And all this AT NO COST!