HP UX security checklist?

[SandiC]

Recently we are getting a lot of bad login attempts. Lastb reveals foreign ips that are attempting to guess login ids.

What is the best way to start locking down our system? Does anyone have a security guidleine checklist and an idea of how to block these without changing our ip and creating a vpn? We are hp ux 11.11 64 trusted sys setup.

tia,
Sandi

[Steven E. Protter · Accepted solution]

Shalom,

I assume your system is exposed in some way to the Internet.

Checklist:
1) If possible use a firewall to limit from where login. If you can limit the networks permitted to log in, you can drastically reduce the scope of this problem.
2) Consider using tcp wrappers (free from http://software.hp.com) to limit logins more smoothly.
3) If these are ssh login attempts, change the root login in sshd_config to only key based logins. This will make root access attempts useless because to login as root you will need to first place a public key on the system. Creates a good chicken or egg situation for you.
4) Use Bastille (http://software.hp.com) to harden your system and stop running services that are not needed.
5) Stop using telnet and ftp, use ssh and sftp. The latter two encrypt the data stream and authentication, which makes it less likely that you will be hacked.
6) Stop using r protocols in inetd.conf. Transfer rate will drop due to the data stream being encrypted, as will authentication speed.
7) Tighten file permissions in general. World writeable is bad.
8) Tighten umask for users. Make files less vulnerable.
9) Make sure you run security_patch_check (Bastille) and install all needed security patches.
10) I did create a daemon that shuts down ip addresses that have too many bad logins but it created a very long firewall block list. I can try and dig it up if you want.

This list is not complete but is a good start.

SEP

[Juan M Leon]

I will encourage to use tcp wrapper like Steve suggested.
This way you can always update the allow/deny file with the IP address that you want to allow access, anybody else will not be prompted for password.
This way you will reduce the amount of alerts in your file.

[spex]

Sandi,

Steven has provided an excellent checklist. As he recommends, the first line of defense is a good firewall.

PCS

[SandiC]

Thank you so much. Am not familiar with Bastille, but sounds like a good place to go.
Sandi

[Pierre Pasturel]

Sorry for the shameless plug .... :)

But also consider HPUX Host IDS for monitoring such things as the creation of world-writable files, creation of privileged setuid/setgid executables, and modification of critical files.

The latest release is V4.1. You can find the product web page at http://h20338.www2.hp.com/hpux11i/cache/324806-0-0-225-121.html

Pierre

[SandiC]

Thank you all!
I'm downloading the TCP wrapper right now.
SO it would allow me to in effect block all but known ips? The bad attempts appear to be coming from servers that I suspect change their addresses often.

[Steven E. Protter]

Shalom,

Yes with tcp_wrappers you can limit the networks from which login is permitted, any protocol.

SEP

[Steven E. Protter]

Shalom,

Yes with tcp_wrappers you can limit the networks from which login is permitted, any protocol.

http://www.linux.com/feature/61061?theme=print
This is a linux link but tcp wrappers works the same way on hpux. Also good docs on docs.hp.com

HIDS is probably overkill and can likely use up all your processing power. Used in a limited way you could use it to detect and define malicious activity. You however have already identified the problem, script kiddie login guesses.

11) On my list. Insure all non-system users have complex passwords.

SEP

[Pierre Pasturel]

Steven wrote:
"HIDS ... can likely use up all your processing power."

We did deliver significant performance improvements in Dec 2004 starting with HIDS v3.0. The impact of HIDS on CPU and memory usage depends on:
1) The HIDS configuration: what you tell it to monitor and how well you have tuned HIDS to filter unwanted alerts. We delivered a centrally managed tuning tool recently with HIDS v4.1 to facilitate collecting, reporting, and filtering unwanted alerts.
2) The system load profile: specifically, the rate at which your applications & system generate the kernel system call audit records that HIDS processes for doing detection. For details, please refer to the HIDS tuning/sizing paper that is available from docs.hp.com (follow the documentation link provided at the HIDS product web page).

Pierre

[Keith Buck]

A few additional thoughts:

1. Bastille will help you setup a basic ipfilter firewall (if you install ipfilter). The basic setup allows all outgoing traffic (and stateful return) but blocks all the incoming ports except the ones you allow. Bastille is intended to be the checklist you are looking for; we took into account several other checklists and chose what we felt were the most important things to focus on and implemented those first. Bastille is now in its 3rd generation and although there are things we'd like to add, it should be a fairly comprehensive start. On 11.23/11.31, you can even select a "one-click" Bastille hardening level at install-time (although going through the GUI is intended to be very educational too)

2. Software Assistant is replacing Security Patch Check. It includes much improved reporting and automatic downloads, integrity checking, and depot creation for patches. You can get it at https://www.hp.com/go/swa
Bastille can setup a cron job to run a report nightly.

Hope that helps.

-Keith

[Robert Fritz]

I'd recommend IPfilter over TCP Wrappers for control and performance. IPFilter is built into the Kernel and comes standard with the OE, so it is tuned to work with the HP-UX Network stack with negligible performance degradation, unlike TCP Wrappers. It is fully supported, and free. It allows more control than tcp wrappers. In addition it provides better UDP/ICMP support, support for multiple layer-2 stacks, handy configuration and rule-testing programs, and neat features like connection-allocation. In addition, Bastille can give you a handy "starter" firewall as Keith mentioned with little work... just the use of an install time security level (in Ignite), or a run through the Bastille security-wizard.

[SandiC]

Thank you! now at least I have more options!

[SandiC]

Starting with Bastile to see what is recommended. Thanks to everyone!

Sandi