audit HP server

[Ferdinand_2]

Hi there,

I have been asked to audit an HP-UX server from a colleague on another project.

What would be a good way to go about this?

I do not want to install anything. I just want to know if the machine performs well and if it is configured correctly (no serious security faults)

The report is mainly for the admin but should also be readable for the 'suits'.

Any tips???

[U.SivaKumar_2]

Hi,
Have a look at this link.
http://www.vennerable.com/security.html

regards,
U.SivaKumar

[Michael Tully]

If you didn't want to install software, there are some basic commmands to use to see that the system is reasonably secure.

Check some file permissions on OS filesystems
find / /opt /usr -xdev -type f -perm 666
find / /opt /usr -xdev -type f -perm 777
find / /opt /usr -xdev -type d -perm 777
The man and cat directories should be ok.
Make sure all mountpoint directories do not have permissions any greater than 755

Check 'root's umask, should 022

You should have 'nosuid' for most, if not all mountpoints (excl. /usr and /opt)
Sticky bit setting for /tmp and /var/tmp

Check where the 'root' home directory is. Should NOT be in /

I don't have a script, but here's a start.
There are a number of tools out there that can be used, especially the document on creating a 'bastion' server and more recently HP-UX bastille.

[Alan Casey]

Check out the following site:

http://www.auscert.org.au/Information/Auscert_info/Papers/usc20.html

This is the checklist many professional auditors use.

[Nick Wickens]

Theres also sekchek which I think is a free download from Deloitte Touche Auditors at

http://www.sekchek.com/

These links detail earlier discussions -

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x998e107d277ad611abdb0090277a778c,00.html

http://bizforums.itrc.hp.com/cm/QuestionAnswer/0,,0x3c6d107d277ad611abdb0090277a778c,00.html

[Ferdinand_2]

Michael,

I've run that find commando on one of my own machines but what am I seeing here?

btw, it is the thing I am looking for, normal UX commands which will show/ tell me someting.

(mowdb251)/ # find / /opt /usr -xdev -type f -perm 666
/etc/SnmpAgent.d/snmpd.conf
/etc/opt/resmon/persistence/runlevel4_flag
/opt/ifor/ls/res/i4adminX.pdl
/opt/hpnpl/tmp/ljx0003379
/opt/pred/bin/PSERRLOG
/usr/newconfig/var/stm/config/tools/exercise/hosts.cfg
/usr/share/man/cat1.Z/NIS+.1
/usr/share/man/cat1.Z/nis+.1
/usr/share/man/cat1.Z/nis.1
/usr/share/man/cat1.Z/X.1