Security queries

[Tim O'Connell]

Hi,

I have been asked to look at 2 HPUX 11 servers in a company we have taken over & have some queries.

1. Neither system is set up as a trusted system with no password ageing etc. Passwords held in encrypted form in /etc/passwd. My own servers are trusted systems since day 1. Am I correct in recommending that they should be trusted.

2. Root should only be able to login at console & not ftp - correct? All users are allowed ftp which I don't agree with. No secure ftp
There is no Web console.

3. Ignite not being run - this should be run regularly & the files copied to the oposite server. This is what I do on my servers & need to know if this is correct.

4. Finally, I run SysInfo on my servers once a week on the crontab & copy off the output. There is no SysInfo on these servers. Does this need to be downloaded & installed.

Thanks,

Tim

[RAC_1 · Accepted solution]

All correct. go ahead and do that. You may also want to check that ignite versions are latest on these systems.

[Steven E. Protter]

Shalom Tim,

So long as you are not using NIS going for trusted systems is a good idea.

Ignite should be run on all systems once a week . If the system has a tape drive, I advocate make_tape_recovery, if not use make_net_recovery to a NFS shared mount point.

I also recommend downloading and installing Bastille and PERL5 from http://software.hp.com in order to make your system more secure.

root should NEVER have ftp access. Its a major security flaw to permit it and because ftp sends paswords back and forth in clear text, its a great way to get your root password hacked.

Secure Shell (software.hp.com) should be used in place of telnet.

SEP

[Peter Godron]

Tim,
it's probably down to what you get used to.
Even if the data is not critical, the machine would still give access to your network.
I would certainly go ahead with your suggested changes, even only to get the new systems to the standard required in your company.
May be worhtwhile running a few checks on the systems to ensure they were not compromised. Audit all the users and get them to chnage passwords etc..

[G Svedvall]

Hi Tim,
I agree with the earlier replies, but be a bit careful with question number 1.
If you are going to Trusted System mode and are running e.g Baan, you can cause quite a lot of trouble for users and admins since some applications do'nt "talk" with the OS/security system,

[Tim O'Connell]

Hi All,

Thanks for all the replies. The system is only running Oracle so moving to a trusted system shouldn't be a problem.

Where do I get SysInfo to install

Many Thanks,

Tim

[Arunvijai_4]

Hi Tim,

Here it is : http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sysinfo-3.3.1/

-Arun

[Tim O'Connell]

Many thanks,

Points assigned

Tim