Securing an HP UX B.11.11 server

[patrick_119]

Hi,
Need some help. We are trying to secure our HP UX 11i servers. We have tested Bastille and its great. However after running a server scan using nmap we can see some strange port numbers OPEN. They are in the 49xxx range listed with an UNKNOW description.

1. What are these ports used for ? Why are they listed as Unknown. I know i cannot see them in /etc/services.

2. I have read that the tool lssof is great for more info on these ports among other things, but i cannot get the executable for B.11.11 anywhere. Can anyone help me.

3. Also what does syslogd -N achieve by way of security.

4. We are trying to secure a large no. (20) HP servers. These are in a pre-production stage now and the application vendors are very itchy as they are having problems with their apps. The apps include Mediation, fraud mgmt., telecom billing and web self care. Since the situation is delicate we wish to tread very carefully about this. Our company does not as yet have a comprehensive security policy. Therefore our plan is to first prepare a document covering the server security lockdown procedure and get it ok'd by apps vendors. This hopefully would help avoid getting the blame for problems later. Can anyone give me some tips, links, template etc for such a document.

5. Any tips, methods, etc that i can use to secure these systems would really help since we are new to HPUX.

Thanks very much for your patience,

Regards

Patrick

[Paula J Frazer-Campbell]

Hi


Re:-
1.

Have a look in /etc/services and remove the items not required.

Make a backup first.

Paula

[Paula J Frazer-Campbell]

This will help



http://www.hp.com/products1/unix/operating/infolibrary/whitepapers/building_a_bastion_host.pdf


Paula

[Paula J Frazer-Campbell]

Hi

That link did not work so:-

http://secinf.net/unix_security/Building_a_Bastion_Host_Using_HPUX_11.html


Paula

[Hazem Mahmoud_3 · Accepted solution]

You can obtain lsof for 11.11 from
http://the-other.wiretapped.net/security/host-security/lsof/binaries/hpux/B.11.11/
or I believe this will also work:
http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.69/

Once you get lsof you can determine what the ports 49xxx are used for.

For info about securing HP-UX, check out http://www.sans.org/rr/papers/63/325.pdf
or also consider purchasing "HP-UX 11i Security" by Chris Wong. Excellent book to learning all the details about securing HP-UX!

-Hazem

[Bill Hassell]

In providing a secure environment, the sysadmin (and security policy) define the environment, so if an application vendor's product has a problem, the vendor must define the issue and either fix their product or provide a risk analysis concerning fixing the problem. There are some AWFUL products out there that *require* 777 permissions on data directories or require root as the owner of their processes. Another problem with these awful applications is that they do not provide any error messages or inadequate messages concerning failures.

I would NOT tread lightly in this area since your applications are themselves associated with security issues. Since you may not have the credentials to defend the security position, you may need a certified security specialist to help with both a policy as well as negotiations with vendors.

[patrick_119]

Many Thanks to everyone. The tips have been very helpfull. Thanks Hazem for lsof. its a real help. Thanks Paula for the link. Thanks Bill for your advice. All inputs will help me tremendously.

regards

patrick