Security Access

[Ray Bell]

I want to disable all the R's (remsh, rlogin, rcp and etc) on my server and allow certain i.p. address to acces my server. I tried to set up up in file /var/adm/inetd.sec but must have not implement it correctly. I need some assistance. Also do anyone know a good web site that talk about security issues and patching up your server against hackers.

[Vincenzo Restuccia]

For info of inetd see:
http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90685/B2355-90685_top.html&con=/hpux/onlinedocs/B2355-90685/00/00/10-con.html&toc=/hpux/onlinedocs/B2355-90685/00/00/10-toc.html&searchterms=inetd&queryid=20010606-085725

see also IPSEC:
http://docs.hp.com/hpux/onlinedocs/J4255-90005/J4255-90005.html

[James R. Ferguson]

Hi Ray:

Here's one specifically for HP-UX, for starters:

http://secinf.net/info/unix/secureHP-UX.html

...JRF...

[Mark Fenton]

Ray, the inetd.sec file should be composed of lines like:

telnet allow 192.168.*
rlogin allow *.mynetwork.net

or you can tool it down to a particular host.

Happy locking down...

[Peggy Fong]

There is a document on building a bastion host that is very comprehensive...and is a good starting place. It does cover disabling the r* and many other things for hp.
For 11.X
http://people.hp.se/stevesk/bastion11.html

For 10.X
http://people.hp.se/stevesk/bastion10.html

The security forum has many good things as well just do searches for topics and you should find good info as well as references to sites for public domain code, etc.

The previous references are great starting points as well for HP security.

Regards,
Peggy

[Peggy Fong]

BTW
If you want to completely disable the r* services (rcp, remsh, rlogin..) and only allow telnet, then you need to comment them out of /etc/inetd.conf and then re-read the file by running 'inetd -c'

Then use inetd.sec to allow telnet from certain subnets or ip addresses....


Peggy

[Shannon Petry]

Also remember to read the man pages. These are not written for rocket scientists, and are handy on all platforms.
>man inetd.sec
will give you plenty of information, and examples on building the file correctly, even tell you to run inetd -c to implement the changes while inetd is running.

Reading about bastion hosts, and C2 security is fine, but not really practical for a newbie.

Regards,
Shannon