Anti-virus for HP-UX server

[Tan Shirley]

Hi all,

I'm having a few HP-UX servers (K, L, N-class) which are having private IP address. I would like to ask, is it necessary for me to purchase and install anti-virus onto them? Since they are not public IP address, hence internet world can't access them, neither can they access out to internet. So I would assume that it's quite impossible that would be infected with virus. Users only access the servers via telnet session. Even if our users, running on Microsoft Windows NT/2000, get infected with virus and pass on to the HP-UX servers, I doubt the virus script will work in HP-UX. But I would still like to hear what you guys have to say. Any suggestions or comments? Thanks so much !

[Nick Wickens · Accepted solution]

I would'nt worry unduly at the moment, I have heard only a few stories of Unix viruses most of which just turn out to be security flaws rather than a malicious virus and which are quickly patched and as you are not connected to the net its unlikely you will be hit.

Its our collegues on the Micro$oft systems that need to worry as these are the main targets for malicious attacks.

Might be worth subscribing to the daily security bulletins from HP though at this link -

http://europe-support.external.hp.com/digest/bin/doc.pl/sid=995b8f980885d718d0

[sven verhaegen]

I have to agree with the less importance to virus control .. most unix virusses tend to be worm-type virusses intended to suck you memory or CPU time .. they are not wide spread , a good firewall/proxy and access server control to the external world is far more valuable to the UX machine then is the virusscanner (I have no knowledge of any such thing existing for HP_UX) as the Ux environments are more prone to attacks of denial or stealing of information the fireawall is the suited approach for that , as you say you have little to no external world conatct the only way to get hacked or infected would be internal people getting into the ux machine .. as said its better to look at the ux secirty issues then to bother about actual virus treaths

[Sukant Naik]

Hi,

I have not come across any virus attack on my HP-UX server farm.

There are antivirus softwares available. I have evaluated Sophos software and it is sufficient.

Virus attacks come into picture when u r using SAMBA/CIFS on a hp-ux box.

Or else u can still be happy without an antivirus s/w.

-Sukant

[Paula J Frazer-Campbell]

Hi

Follow this liks - lots of info.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xeb661012aa92d5118ff10090279cd0f9,00.html


Paula

[harry d brown jr]

NO.

The ONLY reason you would EVER get any kind of anti-virus software is if you are allowing M$ users to store and share files amongst each others, like with samba or NFS.

And the software is ONLY to PROTECT other M$ users, because M$ virus's do no INFECT UNIX systems.


live free or die
harry

[Tan Shirley]

Hi guys,

Thanks so much for all the comments! 10 points for all of you! Really nice to have such prompt response in the forum.. Thanks once again.

Regards,
Shirley

[Wodisch_1]

Hi Shirley,

why not use OpenSource Software for this?
There is project on SourceForge.org about AntiVirus scanners:
http://sourceforge.net/projects/openantivirus/
http://sourceforge.net/projects/jvirus/
http://sourceforge.net/projects/godfather/

And some vendors deliver AntiVirus software for UN*X/Linux...

FWIW,
Wodisch

[Pete Randall]

What a bunch of ostriches. Don't you guys get tired of getting sand in your eyes, ears and noses? Get your head out of the sand. The only reason there haven't been that many attacks on HP_UX is because Micro$ucks is such an easy target but that doesn't mean it's going to remain that way. Originally Linux users touted their low attack count as an advantage over Micro$lop, too. There is no such thing as being too cautious when it comes to protecting the company's assets. You need a damn good firewall, good virus protection and whatever other protection you can find, no matter what the platform. It's just a matter of time.

That's probably four or five cents worth of ranting but it's still -
just my $.02

Pete

[Robert Gamble]

Here is the thread when I posted a similar question back in 2000.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xdd0b6d96588ad4118fef0090279cd0f9,00.html

Good Luck!

[Shannon Petry]

Here is a cut of something I wrote a couple/few years back.

As for Pete's comment about the head in the sand, I dont quite think it is the case.


I am not an HP official, but have been working in the UNIX environment for more than a decade. (Old timer kindof). Here is an explenation of why virii do not exist for UNIX.

First, I should say that there are many "trojans" for UNIX, and are very easy to make. I.E. A script that calls /sbin/rm -f /* executed by root will delete the files under / (exception would be /sbin and /sbin/rm and the shell because they are in use). While some people consider trojans a virus, they are not.

Virii have certain characteristics which would define them as virii. First, a virus is usually memory resident. This means that the virus sits in memory and looks for keys to attack files. Usually the dos extension to the file name. I.E. .exe files and .com files. Also virii must be at least a nuisance. like writing "eat my shorts" into a text file would cause an unwanted change to the file. A program that sat in memory and wrote our ficticous message to files would be a virus. A virus must also spread itself in one way or another.

Because the virus usually needs a trigger (like the dos extension) UNIX virii are much more difficult to create. Since /usr/bin/rm is an executable not denoted by rm.exe, the virus would not be able to tell by name what is an executable to infect and spread, and what is not. /etc/hosts would look the same to a virus as /etc/ping. A virus would have to be huge to sit in memory and be able to stat all files, run magic, check bits, etc... to know how to spread.

Next, in UNIX the kernel is memory resident. When the system boots the kernel, it is read only. The kernel sits in memory until system shutdown. If a virus was to infect the kernel, it would not be effective until the system was rebooted with the bad kernel. In Win/XXXX the kernel sits on a disk, and is constantly accessed. Sorry Gates and Clan, but a 100MB kernel just does not fit into most PC's memory :). If the kernel is corrupted, the corruptions are instantly read in, and accepted. Microsoft was supposed to fix this in Win NT 4.0, then in 2000, but I guess they will just let saps keep buying their products and spending tons of cash on anti-virus software and think that is has to be that way.....How easily some of us are fooled :)

The next problem with running a virus in UNIX is that the virus can only run at the access level of the user who executes the program. I.E. If johndoe executes the program, the program can only affect "johndoe"'s processes and files. Anything owned by "root", and "bettysue" would be unaffected. The virus could only do wide spread system damage if the super user "root" executed the virus. This severely limits the ability of a virus in UNIX. Windows NT and 2000 also have multi leveled access for processes, but Microsoft's implementation is very easy to bypass. Another fine programming job by the wonderfull folks at Microsoft! :)

In SunOS and Linux, the virus scanning software that is available is NOT for UNIX and Linux protection, but Microsoft Windows protection. The software is made to scan data shared to and from Windows boxes.

The best defense in UNIX to the Virus threat is common sense, built in UNIX functionality, and basic security measures available in more locations than I would care to give in this reply.

Tell the person asking for Norton AV for HP-UX that it is only necessary in Microsoft world. While him and sooo many others think that Crashes and Virus threats are daily concerns, us UNIX folks know better!

Sincerely,
Shannon Petry
Systems Engineer

[Wodisch_1]

Hi again,


actually I did write a shell-virus back in the 1980s (for investigation purposes and it was never published, so - hopefully - I am not a bad guy by telling it), and the result was:
- virii DO work under UN*X
- even something as simple as one page of shell script can infect a whole network of *different* UN*Xes
- started as an infected USER-script it managed to infect ALL scripts on the whole computer and then the other systems in the test environment

Sorry, Shannon, but the virus could use "file(1)" to check for the file type quite easily :-( And a virus doesn't have to infect the kernel to be working - just imagine it infected "/usr/bin/true"...

Of course, a virus scanner wouldn't help that much (and slow down your system to the point of uselessness), so *we* will need something in the direction of "TripWire", to detect changed/sabotaged files (codefiles especially: netstat, ps, lsof, file, more, sh, ls, strings, chksum).
And we will need "least privileges" from the very installation on! (HP, that's to YOU! And to Sun, IBM, RedHat, SuSE, ...)

I strongly believe that we (the UN*X guys'n gals) are NOT having lots of the virus problems due to pure LUCK: the usual virus-programmer does not know HP-UX at all!
Firewalls and scanners don't work INTERNALLY in your intranet; who of you has loaded something from the HP-UX porting archives? Did you verify the MD5 checksums? Did you verify the text with those checksums against the authors/publishers PGP keys? Did you compile it yourself? Did you do any kind of code inspection with the source? Even for the compiler and tools?


Tan, statistically more than 80% of all attacks come from people INTERNAL to your network! Firewalls don't help there! But NEVER, EVER use TELNET!!!
I am quite happy that HP finally decided to support SSH - use that. Start NOW - it's free, even for Windows :-)
TELNET (and FTP and all the old-school tools) transmits passwords in plain text, i.e. NOT encrypted. Everybody able to connect to your network can listen to all the packets
transmitted, and EASILY learn all the passwords used by TELNET/FTP/RLOGIN sessions! (I own a Linux PDA, which is able to da that - and it fits into my shirt's pocket easily)
Would you think that some of the users accessing your UN*X servers could use the SAME passwords on UN*X and Windows?
Of course, this is beyond the scope of the direct question you asked, but if you do not stick to it literally, it's still the same topic!

BTW, did you know that the next saturday is the "World War-Walking Day"? Lots of people running around with WLAN equipment to detect open WLANs!

Sorry for being aggressive on that topic,
Wodisch

[Pete Randall]

Thanks, Wodisch. I'm with you. To me, it's just a matter of time.

Pete

[Nick Wickens]

Just seen Petes comment about Ostrich's which I don't think is a fair assesment of responses. I think we are all aware of the potential but at present the people who feel it necessary to write these viruses are content to stick with Microsoft products as no matter how good the products Microsoft are the world leaders in the publics eyes and hence the "best" target.

Firewalls etc should now be the standard for any site with external access and this should guard against any attack on Msoft products and potentially Unix attacks but we should not be complacent and must be on our guard for such attacks - hence my suggestion to monitor HP security bulletins. Also we should all be monitoring IT press releases and alerts and I am sure we all do this as a matter of course.

I for one took the course of action to get an HP Security consultant onsite as soon as it looked likely that our network would have incoming access from the net and would suggest that everyone else does likewise with an annual review from HP as a minimum.

[Pete Randall]

http://www.mi2g.com/cgi/mi2g/press/100902.pdf

I rest my case.

[Jac Kersing]

Hi,

At this moment the risk of infection of your HP-UX box is extremly small, the number of HP-UX systems deployed is very small compared to the number of Window$ systems, so it's not a very attractive target for Joe Avarage Hacker. (As HP-UX systems will often be used for business critical computing it could be an attractive target for others)

Using only telnet for access to your host reduces the infection risk even more as propagating a virus over telnet is extremely unprobable.
Ssh connectivity protects your data while in transit (good), but the session forwarding mechanism that allows one to connect to the next host with the credentials used while connecting to a host also allows for transparent file transfers and remote command execution. This opens the door for easy virus propagation (bad.) As the use of ssh increases this might open a new can of worms...


Regards,

Jac

[Shannon Petry]

Sorry, just read the tail of this one.. ;(

Wodish,
Some of what you say is true, but some is not.


I never said a virus has to be in a kernel, only that the windows kernel is an easy target.
Virii in windows can easily look at .com, .exe, .dll and know what to infect. Imagine the amount of work and time it would take for a virus to find every file on your computer and do a file(1) on it and evaluate the output.. I think within the first 12 hours it was running someone would find the thing running and kill the process.

A virus and a trojan are different. If you download joe schmo's code, and compile it and run it without looking, then shame on you! But joe schmo's code is not a virus, you had a brain fart.

Trojans are easy to create, and I have written quite a few myself as tests. (not early as you did so Im a couple years younger! har har), however they are not globally effective with good sysadmin practices.
I.E. I made a trojan and called it "ls". It copied itself in every place it could each time it ran. This is a way to test who had the "." in their path, and show the hard way what sysadmin need to be aware of.

Are there root kits for Unix? Yes, and be weary! if you dont know how and what to do to secure your systems, best hire someone or buy lots of books and get working on it. A root kit is not a virus, it allows a non root user to have access as root.

M$ said NT/2000/XP will make us as safe as unix. Guess what, most applications fail to run if your not an administrator in NT becaues microsoft's implementation of everything is flawed. (everthing being process control, file acl's, network port access, etc...)
In Unix world good sites have 1 root account on a system, and tight control over who has the access to it. If we had to make all our users UID=0 then we may have to worry more about viruses.



I agree with you 100% that telnet and ftp are so easy to sniff passwords people have heart attacks when you show them, so OpenSSH is awsome prevention.


SO, as for it being a matter of time.. Not hardly.. here is why

A virus in windows is effective because it corrupts the system completely, and launches itself at boot time with the kernel or dll corruption, and has fast access to any files it deams executable to tag itself into/onto.
unless "root" ran the virus in unix, the same thing is not possible. (unless there was a really sloppy admin that ran chmod -R 4777 / that is.
Also, since the kernel is immediately corrupted in windows, the highest level is corrupted. killing the process in memory is useless as the next time the kernel rereads itself (1-2 minutes) the virus is reloaded.
In unix, killing the process kills the virus.


SO I guess my official response to the question "Can a virus live in UNIX?" the answer is twofold. "Yes, but it would take so much development time that we wont ever see it."

Grand discussion though! ;)

Shannon

[Wayne Yu_1]

One of our server A180 running HPUX 11.0 had the whole root volume corrupted for no reason -- no one actually loggin to it, it only run some cron job to sync files from RedHat web site and acting as file server to few internal Linux servers. None file system was full at all. The system will boot but right before it runs init, it stopped booting and showing garbages on the console.

Strange enough, another customers of ours called today told us their system had exactly same problem today -- boot not continue at the point start init. Their computer has no connection to ours and geographically 4,000 miles away. They could not find a reason for the corruption either.

Is there a known virus today hurting HP/UX servers?