HP-UX 10.20/11.00 TCP/IP Security issues

[HSBC]

Hello all.

We??re trying to map the TCP/IP vulnerabilities found on our HP-UX machines, but we??re not sure what command to run. We have tried NETTUNE but it doesn??t seem to supply the same comprehensive information as the "NO" command produces on AIX for example.

How to list and to correctly deactivate the unsecure TCP/IP options on Hp-UX?

Thanks!

[Stefan Farrelly]

You want ndd -h supported (and ndd -h unsupported).

Or even better, load some software to secure you server for you;

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

[Ron Kinner]

netstat -a | grep tcp
and
netstat -a |grep udp

will show you what is listening.

You may want to read:

http://www.hp.com/products1/unix/operating/infolibrary/whitepapers/building_a_bastion_host.pdf

http://people.hp.se/stevesk/bastion.html

Ron

[Michael Steele_2]

Tcpdump also helps:

http://hpux.cict.fr/hppd/hpux/Networking/Admin/tcpdump-3.6.2/man.html

[HSBC]

Thanks for all replies!

"Ndd" has a very nice list of things for tweaking. But, how to proceed if my OS is a 10.20???

[James R. Ferguson]

Hi:

As you noted yourself, if you are running 10.20 the 'ndd' predecessor is 'nettune'.

See the 'nettune' man pages for more information.

Regards!

...JRF...

[Brian Hackley]

Hello,

HP provides a nice port of the Open Source BASTILLE product at http://software.hp.com for HPUX 11.0 and 11.11. Bastille provides an easy to use security audit and set of recommendations for you to secure your HPUX systems. You may need to update PERL before using Bastille.

I know this doesn't help your 10.20 systems at all, but I hope it helps.

-> Brian Hackley