File Permissons for Security

[Simon_139]

Hi,

I have a customer that wants us to follow his security policy for an 11i installation.

I am having trouble with his requests for the following chages to file permissions.

I try them and end up with a cabbage for an operating system. Can anyone offer help as to how close to these I can get please.

Thanks

1. Set all system directories to mode 751
2. Set the sticky bit on all system public directories.
3. Set all public binaries to mode 511
4. Set all administrative binary executables to mode 510
5. Set all public shell scripts to mode 555
6. Set all administrative shell scripts to mode 550
7. Classify all system configuration files. Set public files to mode 644 and sensitive files to mode 640
8. Set disk, tape, network and memory device files to mode 600 and owned by root
9. Set tty and pseudo-tty files to mode 622 and owned by root.
10. Set /dev/null file permissions to mode 777
11. All start-up files such as .profile, .cshrc, .login, .emacs, .exrc, and .mailrc must have file permissions on home directories set to mode 750 and be owned by the accountâ s UID.
12. Identify and record all setuid & setgid executables. Set setuids to mode 4511 and setgids to mode 2511
13. Ensure setuid or setgid shell scripts are not used
14. World write permission must be removed from all files referenced by cron, at, and batch. These configuration files include: /etc/cron /usr/sbin/cron /usr/lib/cron/.proto /usr/spool/cron/crontabs /usr/bin/batch /usr/lib/cron/at.* /usr/lib/cron/cron.* /usr/bin/at /usr/spool/cron /usr/spool/cron/atjobs /usr/bin/crontab /var/adm/cron/* /var/spool/cron/*/*
15. Set the /usr/lib/crontab file to mode 750 and owned by ro

[Ravi_8]

Hi

tell him/her that this is not the way to set security on a UNIX m/c.

[Manish Srivastava]

Hi,

1. Set all system directories to mode 751

This can be done

2. Set the sticky bit on all system public directories.

This is a recomended way of operation so this is definetly achieveable.

3. Set all public binaries to mode 511
This should not be a problem. Looks like all the users can execute the binaries.

5. Set all public shell scripts to mode 555

this is fine

6. Set all administrative shell scripts to mode 550
this is fine


It will help if you let us know what kind of issues do you see when you do set the specification of the customer.

manish.

[Robert-Jan Goossens]

Hi Simon,

http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

HP-UX Bastille is normaly used the secure a HPUX server, there are some check lists available in the link.

Hope this helps,
Robert-Jan

[Ronald Schwartz_1]

3. Set all public binaries to mode 511
If the world can not read the file they can not execute the file, I think you need 555 on this.

8. Set disk, tape, network and memory device files to mode 600 and owned by root
There are commands that the group needs to have access to these files.

There may be some issues with the existing applications if they are not converted to this format of security.

Good luck