Securing a HPUX box....howto?

[john c]

How do I....
. Disable telnet and ftp
. Disable remote root login

Thank you.

[Steve Steel]

Hi

see
http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90742/B2355-90742_top.html&con=/hpux/onlinedocs/B2355-90742/00/00/64-con.html&toc=/hpux/onlinedocs/B2355-90742/00/00/64-toc.html&searchterms=telnet&queryid=20030711-023544

Basically /etc/securetty ftpusers file and
inetd.sec


Steve Steel

[RAC_1]

Disable telnet (Use ssh)
Disable ftp (use sftp)
Disable remsh (use scp-part of ssh)
Use inetd.sec.

[Dagmar Boelen]

Disable the telnet and ftp-services in the inetd.conf-file. Do this placing a # a the beginning of the definition of this service.

[Sanjiv Sharma_1]

Hi John,

Disable telnet and ftp:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x24fee822e739d711abdc0090277a778c,00.html

Disable remote login:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x8682402f24d5d61190050090279cd0f9,00.html

hth.

[twang]

Take a look at the following,
1. http://www.hp.com/products1/unix/operating/security/
2. http://www.deter.com/unix/papers/unix_security_checklist.txt

[Steve Coates]

Take a look at Bastille, it can help you secure your system.

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

[Steven E. Protter]

2- modify /etc/securetty

1- modify /etc/inetd.conf

comment out the ftpd and telnetd lines

Also comment out any protocol starting with an r unless your box is an Ignite Client.

Read my security speel.

----
Bastille Security hardening
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

Perl which the above needs.
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=PERL

Security Patch Check
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6834AA

TCP Wrappers

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=TCPWRAP

IDS/9000 (Intrusion Detection Sytstem)

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=J5083AA

Get all these products working you'll be quite secure.

Secure shell
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA


-----

Watch for world write permissions.

Have an /var/adm/inetd.sec file.

Make your system a trusted system.

You can do this stuff in a few days.

See attached doc on secure shell

SEP

[Caesar_3]

Hello!

From /etc/services remove the ports of
the wanted deamons (ftp, telnet)

For the remote check the /.rhosts and
edit it only to who you allow the connections.

Caesar

[Michael Tully]

You wish to secure your system.
Start with this document: http://people.hp.se/stevesk/bastion11.html

Then have a look at SEP's suggestions.

If you just wish to remove telnet and ftp you will need to install openssh so that you can connect to the system.

Making changes to /etc/inetd.conf
Place a '#' without the quotes in front of each line you wish to change, then save the file.

# inetd -c (will tell inetd to re-read the config file.

[Sridhar Bhaskarla]

Hi,

Disabling telnet and ftp can be done by commenting out the entries in /etc/inetd.conf. If they cause problems, you can restrict their access by using /var/adm/inetd.sec to only certain hosts.

Remote logins are disabled by commenting out by login,exec and shell services in inetd.conf.

You will need to restart inetd (inetd -c).

However, make sure you have other alternatives to access the server by installing openssh etc.,

Also try using bastille

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

It's free and it can help you quite a bit in tightening the system.

-Sri

[Steven E. Protter]

Mr. Tully,

Thank you for the compliment.

Do you have an alternate on that web site you posted. Its not resolving here.

SEP

[Bill Hassell]

Kevin Steves, the author of the Building a Bastion Host paper left HP some time ago and the paper was mode to a new location: http://www.hp.com/products1/unix/operating/infolibrary/whitepapers/building_a_bastion_host.pdf

Another good resource is Chris Wong's book: HP-UX 11i Security. She will have a seminar at HP World next month.

[Steven Sim Kok Leong]

Hi,

The services you need to disable really depends on what you are using your HP-UX system for.

For instance, if you are using the HP-UX box only as a webserver, you can disable inetd entirely by disabling its equivalent S**inetd startup script to s**inetd in the system startup directories.

Both apache and ssh by default does not depend on inetd to startup. There are other services that do not depend on inetd to startup such as sendmail, lp etc. Do take notice of them when you are securing your system.

Hope this helps. Regards.

Steven Sim Kok Leong