C compiler on HP-UX server

[Aftab Sadiq]

Hi,

Recently we have gone through scurity audit and one of the suggestion to limit
user access to C compiler. Can I control user access to C compiler?

Here is detail about the installed C compiler.
B3901BA B.11.01.20 HP C/ANSI C Developer's Bundle for

HP-UX 11.00 (S800)

Any help appreciated

Aftab

[A. Clay Stephenson]

Typically, the permissions on /opt/ansic/bin/cc are 555; owned by root:bin.

An easy answer would be to change the group for cc to something like "devel" and set the permissions to 550. You then symbolically link /etc/group and /etc/logingroup and make these user members of the new group "devel" - in addition to their existing group membership.

[Steven E. Protter · Accepted solution]

Be careful though.

There is a problem limiting access to the Ansi C compiler.

Oracle needes it to install itself. The way they work on so many platforms is by using portable code, which they compile and make in the host environment. Lots of application software works this way.

I think your security auditors are going over the top.

I'd set up a group called compilers and add the application owners and other that need to comiple and add that as one of roots secondary groups and then add the group to the other authorized users.

Then do what A Clay recommended with permissions.

That should be okay.

Here is my standard security recommendation that will really help out with the audit. No extra charge.... :-)

enjoy
Security Post

Links:


security_patch_check: Checks your system and makes sure its up to date with security patches from HP
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6834AA


Required Perl install

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=PERL

Bastille: Security Hardening Tool

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

TCP Wrappers

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=TCPWRAP

Secure Shell: a replacement for rcp ftp and telnet that encrypts passwords

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA

IDS/9000 Intrusion Detection System which can track security breaches and attempted security breaches.

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=J5083AA

Attached is Chris Vail's paper on how to set up passwordless services by exchanging public keys.

Your auditors will love it, and you may find you know more about HP-UX security then they do when you get done.

SEP