HP-UX 11i on intanium minimun running processes/services

[robert fowler_1]

I have a system running every service you can think of in rcX.d I want to disable all services so that the system is back to a core minimum build that is secure. Does anyone have a list of what the minimum services are required to run hp-ux 11i v2 on intanium processor.

I would build a box myself but sadily I do not own one.

If one has a list of what these services are that would be great to but not my main aim

Thanks in advance

[Olivier Masse]

When you install HP-UX with the SEC30DMZ install-time security, almost all useless services will be deactivated, with only SSH accessible remotely. But if you need a list, you can look into Bastille (which applies the SEC30DMZ level), it has a config file which details everything that it will turn off on a vanilla system.

Running IP Filter and limiting what ports your server listens to is also your best bet since it isolates you from a lot of possible remote exploits.

Besides that, there is the old Bastion guide for HP-UX 11.0 but a lot of "value-added" services have been added since then (SMH, WBEM, etc) so it's less relevant as it used to be: http://www.unixadm.net/hp/bastioning_hpux.11.html

You can also look at a doc I made here:
http://www.mayoxide.com/securing-hpux/phpwiki/ . But it is dated from 2004, unfinished and I have no plans to complete it.

[Emil Velez]

The Bastille program when you run bastille will ask you what services you want to turn on or off.. The nice thing about bastille it allows you to create a config.. apply it and undo it in a single command. Once you have a configuration you can then ftp 1 file to another system and apply the same configuration this way all of your systems are setup consistently.

[Bill Hassell]

If you disable networking, most of those services will be disabled. Of course, most servers are useless without some networking, so start by turning off everything except sshd. No telnet, no ftp, no rexec, no rlogin, no rcp, etc. ssh gives all you need to communicate with the system securely. Bastille will do this and a bunch more security stuff.

But there is a LONG list of useless, almost impossible to determine the purpose of, extra stuff in /sbin/init.d. Unfortunately, there is no easy way to determine what function the obscure scripts are starting. Minimum services is undefinable, but there is a lot of junk that can be dumped. Use Google to search for the mystery features to see if you need these items.

[robert fowler_1]

Thanks for the help so far but I do not wish to use Bastille what I want to know is the minimun services that are installed on minimun build so i can advise a customer what the difference is with his system and what he should look at disabeling

thanks

[Tim Nelson]

First run through the /etc/initd.conf

comment out what you do not wish to run.

Leave telnet
Leave ftp

If you want EMS to work then leave registrar.

A number of items there are self explanitory or there is a man page that desribes the service.

Next step.
run through the /etc/rc.log.

Services like sendmail may not be wanted.
Most other services can be disabled by stopping them and then modifying /etc/rc.config.d/xxx file.

And in the end. review ps -ef output then do your research on what processes are running.

You should be able to get things down to about 70 processes.

[Bill Hassell]

You'll also want to step through all the unnecessary startup config files in /etc/rc.config.d to set their start option = 0.