nddconf ownership question

[Shabu Khan-2]

We recently had a PCI Audit and the auditors gave us this document from the Center for Internet Security HP-UX Benchmark document and wanted us to implement them as much as we could.

I've question on the nddconf ownership, all the files under /etc/rc.config.d/* are owned by bin:bin, but this document says that the ownership should be root:sys and permissions read for everybody, I don't really see a difference, but would like to know why it should be root:sys?

Any thoughts?

Thanks,
Shabu

[Patrick Wallek]

bin:bin ownership is the HP standard. I really don't see any reason to change it, especially with the permissions such as they are (read for everyone).

[Steven E. Protter]

Shalom,

I'm surprised at this document.

bin and root are essentially synonymous.

It makes no difference to security unless an unprivileged user gains write access to a file.

sEP

[Doug O'Leary]

Hey;

bin:bin <-> root:sys; 6 of one. They're protected system accounts which is all that's important.

I am actually a little surprised to a security audit suggest world read capability. That's one area a black hat could research to find out what's configured to run by default and if there are any unprotected scripts that could be hacked.

Remember, everything in /etc/rc.config.d is sourced several times in a boot sequence; if someone could either edit those files or any files they call, they could very easily crack root.

Doug

[Shabu Khan-2]

Thanks Folks.
I am surprised at some of the things that are in the document as well.
Anyways, so basically there is no difference since both are protected but for consistency sake just go with bin:bin?

Thanks,
Shabu

[A. Clay Stephenson]

and a very compelling reason to leave them as bin:bin is that swconfig will restore them to the default HP-UX attributes as will any future swinstall's.

[Shabu Khan-2]

Thanks folks, I appreciate your inputs.
Closing this thread out ...

Thanks,
Shabu

[Shabu Khan-2]

Closed