Permissions under /tcb/files/auth

[Zigor Buruaga]

Hi experts,

OS: Hp-UX 11.00 & 11.11

Following the HPUXBenchmark security policies, I have changed the permissions under "/tcb/files/auth/" to 700. However, each time a user log on ( i.e. "user1", its security file has again the old permissions 644, "/tcb/files/auth/u/user1" ).
I'm sure that I'm missing something here, any help would be highly appreciated.

Thanks in advance.
Best regards,
Zigor

[Zigor Buruaga]

Hi again,

Little mistake, the user security file has again the old permissions 664, not 644.

Thanks!
Best regards,
Zigor

[Prashant Zanwar_4]

Even I have the following in my setup. I believe

# ls -ld $PWD
drwxrwx--x 55 root sys 1024 Mar 19 2004 /tcb/files/auth

/tcb/files/auth/pzanwar not found
# ls -ld $PWD/p/pzanwar
-rw-rw-r-- 1 root root 211 Sep 30 13:44 /tcb/files/auth/p/pzanwar

# ls -ld /tcb
dr-xr-x--x 3 root sys 96 Mar 19 2004 /tcb


I believe at the tcb level it is taken care. Hope this helps
Prashant

[Patrick Wallek · Accepted solution]

No way to get around that, that I know of. I look at the HPUX Benchmark stuff at one point and was not terribly impressed. They recommended setting permissions on lots of files the either 1) don't work (like /tcb), or 2) just flat don't make sense.

[Victor BERRIDGE]

I agree with Patrick,
2) e.g. what is the point for posssible security breach to change /usr/sbin/swapinfo permissions if you can cp /usr/sbin/swapinfo to you home directory and execute it?


All teh best
Victor

[Zigor Buruaga]

Hi again,

OK, "strange" recommendations then ...
Thanks for all the answers.

Best regards,
Zigor

[Chris Calabrese]

It definitely does not make sense to chmod files in /tcb/files/auth when the system keeps changing them back.

And that's why we've eliminated in the upcoming revision of the CIS HP-UX benchmark.

This is just one of many changes due to feedback from the community.

There are also some other changes to reflect feature-changes in the latest HP-UX releases and in add-on the packages for HP-UX (like HP's new Security Patch Check version).

We're just finishing up work on the new version, but it's never too late to send your feedback/wishlist to me at chris_calabrese@yahoo.com.


As for /usr/bin/swapinfo, I'm having a hard time finding reference to that file in any of the HP-UX Benchmark versions that CIS has published. Victor, can you provide me with additional details?

Thanks.

--
Chris Calabrese
Center for Internet Security
HP-UX Benchmark Editor
chris_calabrese@yahoo.com

[Zigor Buruaga]

Hi,

Thanks for your answer Chris.
I will let this thread open, so who wants can give you more feedback about this matter also in this site. The experts are here.

Thanks again to all.
Best regards,
Zigor

[Herman Chim_2]

Hi,

In HP-UX 11.23 & 11.31, system still changes the permission back to 664. Our auditor wants to confirm if the settings is appropriate. Is there a way to avoid the permission change?

Thanks,
Herman