Port Blocking

[Brent W. Moll]

My corporate security manager has requested certain ports be blocked on our servers.

I'm not clear how to do this in HP-UX. Can someone please let me know ?

Thank you :)

[Jeff Schussele]

Hi Brent,

Depends on the ports & services in question.
List a few & we'll show you how to do it.

Rgds,
Jeff

[Robert-Jan Goossens]

Hi,

Check /etc/services on your hpux box.

Regards,

Robert-Jan.

[Sridhar Bhaskarla]

There are couple of things involved in it.

1. Edit /etc/inetd.conf and comment out all the services that are not required to be used. For ex., finger, tftp, bootp, rwalld, rsprayd etc., Look at each service and see if you use them or not.

2. Restrict the access to the services that need to be running through /var/adm/inetd.sec. Look at the file for examples.

3. Disable ip_forwarding feature.

ndd -set /dev/ip ip_forwarding 0

Edit /etc/rc.config.d/nddconf and make the changes.

4. Disable Snmp if you do not need it. Edit /etc/rc.config.d/Snmp* and keep all the variables to 0. If you do need it, then edit /etc/SnmpAgent.d/snmpd.conf and set the community names to non-default and let your management servers know about it.

5. Make use of ftpaccess file. Disable anonymous ftp access.

6. Disable sendmail if you don't intend to receive mail on the box.

etc.,

Look at HP's document to make your system a bastion host.

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000066258828

DocID: USECKBAN00000800

-Sri

[monasingh_1]

I think what you can do is list the port and give them a name in /etc/services file as follows:

name1 20/tcp name1 20/udp

port 20 is intended to be blocked

after this add following to your inetd.sec file:

name1 deny *

after this run:
#inetd -c

I think this should help you block the ports..

[Jose Mosquera · Accepted solution]

Hi,

The file /var/adm/inetd.sec is very useful to improve services security, in this file you can allow|deny parcial o enteramente a specific service, to more info "man inetd.sec"

Other related file is /etc/inetd.conf, more info about: "man inetd.conf" "man inetd"

Rgds.

[Ken Hubnik_2]

/etc/services is where you manage ports.

/etc/inetd.conf has a list of services that you can change. This is where we changed (secured) the services for our security manager.

/var/adm/inetd.sec is where you can secure (allow and deny) access to some services by IP address.

[monasingh_1]

in my previous reply there is a line feed before second name1 like follows:

name1 20/tcp
name1 20/udp

[Jeff Schussele]

Hi Brent,

Be advised that not *everything* can or should be blocked using inetd.conf, inetd.sec or services files.
For instance you can block NFS requests by simply NOT starting the NFS server.
To do that simply stop it
/sbin/init.d/nfs.server stop
Then edit /etc/rc.config.d/nfsconf & set NFS_SERVER=0 & it will not restart upon next boot.
There are other *services* that can be blocked in similar fashion.

My $0.02,
Jeff

[Sridhar Bhaskarla]

Looks like you got a click on inetd.sec. Please remember as stated by Jeff, inetd.conf and inetd.sec alone will not fix all the ports. They control the services provided by inetd. services is a lookup file.

You cannot block ports like SMTP, NFS, SNMP etc through inetd.sec. Either you can enable them or disable them. They have their own configuration files to set the access.

Just for the records.

-Sri

[Chris Vail]

I'm attaching a document which will help you harden HPUX 11.0. It should apply pretty much to other versions as well. It includes port blocking, mods to CDE and other goodies.


Chris