Security best practices at 10.20

[R H_1]

I would like to know all the best practices for tightening security on a 10.20
9000/800 server so I don't miss anything out.

It has been trusted and the latest security patches loaded as detailed in the
latest security patch matrix.

Thanks

[Bruce Baillie_1]

Robert,
One thing I just learned the hard way, do not export an NFS file system to
everyone. Specify each system it will be mounted on. Security just caught me
with a scan.

[Paul Winchcombe_1]

It seems you have done most of the main things.

For further security montior setuid and setgid programs

find . -perm -4000 and find . -perm -200 and compare changes say every week.

Monitor .rhosts and host.equiv as these allow access without a password.

Use inetd.sec to prevent unathorised connection or alternatively edit
/etc/inetd.conf and comment out all daemons not being used, save and then run
inetd -c to read changes.

Make sure console is secure - If I can get to the console I can reboot into
single user mode and no password is required for root access.

Edit file /etc/securetty to prevent remote users from login directly as root.

Disable and disconnect all modems from machine.


Thats all I can think of for now. This is a very extensive subject and I have
only scratched the surface

A good book is Practical UNIX & Internet Security by Oreilly.

Regards

Paul

[Ralf Hildebrandt_1]

1) Unleash a security scanner on your system: www.nessus.org
2) Install Wietse Venema's tcp_wrappers for increased logging and finer
granularity regarding access to your tcp services. Restric all access except
for some machines.
3) Modify the the way tcp sequence numbers are generated -- HP uses by one
increments as default.
4) comment out echo, discard, time form your inetd.conf
Nobody uses that anyway