HPUX Security Checklist

[Wong_3]

Hi all,

I am relatively new to HPUX administration and security, however, my boss has requested me to do a security checklist in case for both internal and external security audit. I have search the internet but mostly found checklist for Solaris not HPUX. Anyone has got a complete checklist and solutions? Please help! Thanks!

[Michael Tully · Accepted solution]

Hi,

The best way is to set up your system as a
'bastion' server. You can find information
on this at the following link:

http://people.hp.se/stevesk/bastion11.html
(patches are mostly out of date, but the ideas
are not!)

Here are some other links which are useful:

http://www.deter.com/unix/papers/unix_security_checklist.txt
http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x4499e7e60861d511abcd0090277a778c,00.htm

HTH
-Michael

[Sanjay_6]

Hi Wong,

Take a look at these two threads,

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=6750f0b310d9d6a519/screen=ckiDisplayDocument?docId=400000000010419

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=6750f0b310d9d6a519/screen=ckiDisplayDocument?docId=200000055001000

Hope this helps.

Regds

[Steven Sim Kok Leong]

Hi,

You can also base your checklist on the following articles from the SANS reading room:

1) HP-UX 10.20 from "Out of the Box" to Secure

http://rr.sans.org/unix/HPUX_1020.php

2) Securing HP-UX 11

http://rr.sans.org/unix/HP-UX11.php

3) Securing a HP-Unix Production Server

http://rr.sans.org/unix/sec_HPUX2.php

Hope this helps. Regards.

Steven Sim Kok Leong

[Steven Sim Kok Leong]

Hi,

You can also base your checklist on the following articles from the SANS reading room:

1) HP-UX 10.20 from "Out of the Box" to Secure

http://rr.sans.org/unix/HPUX_1020.php

2) Securing HP-UX 11

http://rr.sans.org/unix/HP-UX11.php

3) Securing a HP-Unix Production Server

http://rr.sans.org/unix/sec_HPUX2.php

Hope this helps. Regards.

Steven Sim Kok Leong

[Steven Sim Kok Leong]

Hi,

You can also base your checklist on the following articles from the SANS reading room:

1) HP-UX 10.20 from "Out of the Box" to Secure

http://rr.sans.org/unix/HPUX_1020.php

2) Securing HP-UX 11

http://rr.sans.org/unix/HP-UX11.php

3) Securing a HP-Unix Production Server

http://rr.sans.org/unix/sec_HPUX2.php

Hope this helps. Regards.

Steven Sim Kok Leong

[Steven Sim Kok Leong]

Hi,

Oops, have accidentally submitted too many times when encountering errors during submission.

Please ignore the duplicates. Regards.

Steven Sim Kok Leong

[harry d brown jr]

Wong,

Using the bastion host paper that Michael provided a link for also includes a "white" paper for 10.20:

http://people.hp.se/stevesk/

Using it with the combination of the other ideas posted here will help you "protect" your hosts. When providing any kind of internet products, it's also a great idea to have not only a fire wall on the outside (facing the internet before your servers), but also behind your internet servers (before it hits your corporate lan). Your internet area is usually called a DMZ. Here we have two different vendors, a Cisco pix on the outside, bastion hosts (see the link above) and then a Checkpoint or a Raptor (depends upon the app) firewall on the backend, plus our routers filter the crap out of things. We use VERY direct routes, meaning every connection from the DMZ back to the corporate lan has static routes, not only on the HP servers, but also within the routers, and firewalls. It's also very important to limit the ports that are open. the fewer the number of ports open (like 80 - http and 443 - https) the more you can CLAMP down.

live free or die
harry

[Wong_3]

Thanks everyone for the great help! I will try to digest all the information and hopefully come up with a list suited to my company policy and environment.

Cheers!!