how can i secury my unix system?

[chuntao luo]

when i use nmap(port scan tools) scan my unix system,it reports:
Remote operating system guess: HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0
TCP Sequence Prediction: Class=64K rule
Difficulty=1 (Trivial joke)
IPID Sequence Generation: Incremental
how can i modify the "tcp_random_seq" to secury my unix system?
thanks

[Vincent Stedema]

Use nettune:

nettune -s tcp_random_seq

But, the OS finger print list for nmap also contains HP-UX entries for tcp_random_seq=1 and tcp_random_seq=2, so nmap will probably still be able to guess your OS type.

HTH.

Vincent

[Shannon Petry]

This is a script I found some time ago, and use on HP-UX 10.20. NOTE: this does not work on 11.0 because of the introduction of ndd!

INSTRUCTIONS: copy and paste this into a file...I call mine /sbin/init.d/fix_ipstack.sh
chmod to 555. Link to /sbin/rcd.2, right after hpbase100's startup.
First time, run it manually....
/sbin/init.d/fix_ipstack.sh start

#!/sbin/sh
#################################################
# Thanks to Ralf Hildebrandt for this one!
#################################################
# nettune: hack kernel parms for safety


OKAY=0
ERROR=-1

##########
# main #
##########

case $1 in
start_msg)
print "Tune kernel vars with nettune and adb"
exit $OKAY
;;
stop_msg)
print "This action is not applicable"
exit $OKAY
;;
stop)
exit $OKAY
;;
start)
;; # fall through
*)
print "USAGE: $0 {start_msg | stop_msg | start | stop}" >&2
exit $ERROR
;;
esac
###########
# start #
###########
#
(/usr/contrib/bin/nettune -s tcp_random_seq 2; /usr/contrib/bin/nettune -s hp_syn_protect 1; /usr/contrib/bin/nettune -s ip_forwarding 0 ;
echo 'ip_block_source_routed/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem )
rval=$OKAY
exit $rval


NOTE also, that securing the tcp sequence is a very small portion of securing a system!

Regards,
Shannon