HPUX Bastion Host Hardening Script

[James Beamish-White]

Hi all,

I am working on writing a script to relatively automate the process for hardening an HP box as suggested by the Bastion Host document. Then I thought that maybe someone has already done it.... anybody?

If not, would anyone like to a) help out in writing the script (I recognise I am only *so* good at scripting), or b) receive a copy of this script once it's completed?

James

[harry d brown jr]

That's a rather hefty task, because hardening, making it a bastian host, usually requires you to NOT install NFS and some other network type components at the point of cold-installation. I've built over a dozen of these bastian servers (we converted all of our virtual vaults to bastian hosts), and what we did, was to build one, and then do a make recovery on the rest (most of our Virtual Vaults were mostly identical). None of our bastian servers have inetd running, and they are surrounded by cisco pix's and Raptor firewalls, as well as port filtering routers.

[James Beamish-White]

To explain myself further, I was planning on making this script from after the point of installing security patches. A question/answer script to check if the system requires inetd or just removal of services.

I have moved to several companies where I need to do hardening inistally before starting to make make_recovery. I would prefer not to do it all manually all the time ;-)

James

[linuxfan]

Hi,


At the present time, there are no scripts that i am aware of, that does this completely. THere are couple of good articles which lead you through it.

In fact HP is coordinating this with (Jay Beale's bastille linux ( http://www.bastille-linux.org ) to come up with something similar for HP) but there is nothing out there right now.

Here are couple of links though

http://www.hp.com/products1/unix/operating/hpux11i/alwayssecure.html

http://people.hp.se/stevesk/bastion11.html

-HTH
Ramesh

[linuxfan]

Hi,

This is what i was talking about.


http://www.bastille-linux.org/press-release-1.2.html

-Regards
Ramesh

[Curtis Larson_1]

I found the armor tool to have some interesting feature that you might be able to make use of

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0xd5dcf841489fd4118fef0090279cd0f9,00.html

[Bernie Vande Griend]

Writing an all purpose bastion script may be difficult as same things depend on an individual's server's purpose. However, I think that a lot of items that are done after the OS install can be scripted. If you do not want to wait for the above to happen, I would gladly help in this effort as it is on my "to-do list" anyway. Let me know.

[James Beamish-White]

Attached is my first cut of the script. The next things I plan to do:

* Try and remember how to add user choice to options.
* Script removal of services in /etc/inetd.conf, and restart of inetd
* Do a check to ensure an admin type user is set up so they can still access the box if they use ssh or telnet.

Note that I haven't even run this script yet, so it might not work ;-)

James

[harry d brown jr]

James,

If I get some time next week, I'll help you out on this, as I now see you have an excellent foundation to build upon. One of the important things, in my opinion (all two cents worth), is that products like nfs, if not being used, should have all the binaries deleted from the system. Thus making a hackers job just that more difficult.

I can be reached at hbrown@paychex.com

thanks,

hdb

[David Lodge]

Feel free to give me a shout if you need some help with the scripting side... I started to do something similar for building a HP-UX 11.00 to our building standards. (fenrir@ntlworld.com)

A point for things like inetd - it is easier to provide a file rather than to try and edit it on the fly...

dave

[Keith Buck]

Hi.

I thought you'd like to know that development of Bastille for HP-UX is underway and the current code is all available using the instructions at:

http://sourceforge.net/cvs/?group_id=403

Also, you can subscribe to the developer's list at

http://lists.sourceforge.net/lists/listinfo/bastille-linux-discuss

I would love to hear your comments about the current status and directions you'd like to see us take. Also, anyone interested in contributing code, check out what you think still needs to be added!

-Keith