Services Running

[Nancy Verkamp]

We are wanting to secure our HPUX (10.20 and 11.0) by stopping services that are not/should not be used. Is there a resource to assist us with this? Has anyone else done this recently that can suggest a method that worked for them?

[Rainer von Bongartz]

Try this ressources:

http://people.hp.se/stevesk/bastion11.html
http://people.hp.se/stevesk/bastion10.html
http://secinf.net/info/unix/secureHP-UX.html

[James R. Ferguson]

Hi Nancy:

You can comment-out the services you do not need in /etc/inetd.conf (e.g. 'echo, 'chargen', etc.) and restart the 'inetd' daemon:

# /usr/sbin/inetd -c

...JRF...

[Ravi_8]

Hi,
inetd is the process that supervises the internet.
if you don't want any kind of activities in your system comment all the RPC lines in /etc/inetd.conf file. excecute the command 'inetd -c' , this will stop all RPC processes and kill the inetd process.

[Harinath N]

Hi Nancy,

To secure your system, you can comment the required ARPA/Berkeley services (telnet, ftp, rlogin, etc.) in /etc/inetd.conf file.
Incase if you want allow these services for some particular users, then you can enable security level for inet services using /var/adm/inetd.sec file(refer man page for inetd.sec entry). Any changes performed in /etc/inetd.conf file can be brought into effect by using "inetd -c" command, which will reconfigure the Internet daemon by rereading the config. file once again.

Further security of your system can be acheived by ensuring proper file permissions(recommended : 644 and in some case 664).

Hope this will help a bit.

Regards,
N.Harinath.

[Thomas D. Harrison]

Nancy,

I'm looking into the same issue myself. I'd recommend the following methodology.

1) Turn on as much logging as you can. This would include modifying syslog.conf. Also do a man on the various daemons to see if there are log options available. (e.g. ftpd has logging options.)

2) After a "suitable" period of time, view these logs.
It might be helpful in the case of /var/adm/syslog/syslog.log to do the following:

cat /var/adm/syslog/syslog.log | grep rpcbind > rpcbind.log
cat /var/adm/syslog/syslog.log | grep LVM > LVM.log
etc...

3) Upon implementation, I would recommend having some tests clearly defined in advance, as well as having the fall back clearly planned.

I wish I could be more help but this is the first time
I'm doing this as well.

Good Luck and let us know if you run across any Einstein-ish ideas as you work on it!