HP-UX Trusted Systems - must install security patches

[Fabrizio Tedone]

Hi all,
I'd like where to look to obtain as soon as possible the list of patches I must install to be able to fully exploit the Trusted System features.
Thanks

[Steven E. Protter]

download this
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6834AA

swinstall it

run security_patch_check

It will list every security patch you need.

Use the patch database link on http://itrc.hp.com to build complete depots with dependencies.

SEP

[Bill Hassell]

Along with the Trusted patches, get a copy of Bastille (you'll need an Xwindow display device) to guide you through a thorough security analysis: http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

[Sanjay_6]

Hi,

you can also do a custom patch assessment for your system, which will hopefully download all the patches you need as a bundle.

http://www1.itrc.hp.com/service/patch/assessSystemsPage.do?admit=-682735245+1091119301048+28353475

Hope this helps.

Regds

[Steven E. Protter]

If you follow Bill's suggestion don't do mine. security_patch check is included with bastille and if you click yes, Bastille adds a regular check for security patches to the cron schedule.

Bill's way as always is superior to mine. I was going to post a Bastille list but got lazy.

SEP
SIT

[Fabrizio Tedone]

Thanks to everyone. Anyway, at this stage I' was looking more towards a documentation list where it is clear which are the mandatory patches to be installed in order to enable all the features of a Trustes System; I cannot run any self assessment on the nodes now because prior to obtain access to the nodes I have to provide this preliminary analysis. Thanks

[Bill Hassell]

The Trusted system features are available out of the box. However, Trusted system is one of several components to security on the system. Thus, you need to scan for all security patches, especially to get the features shown in /etc/default/security (see man security). Just download the securoity_patch_check (http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6834AA) as Steven mantioned. It will produce the report that you need. Additionally, this script will also report on patches with problems, something is often overlooked after a patch is installed. security_patch_check just produces a report.