Services Security

[Pedro Tapia_2]

In order to optimize the security in my server HP-UX who ports and services disable ???. Thank you very much

[generic_1]

If you posted what applications and versions you run you might get a more exact answer. If you get too crazy with it you could break applications or parts of the OS.

[Alessandro Pilati]

Hi Pedro,
take a look on this:

http://sabernet.home.comcast.net/papers/hp-ux10.html#1.0

For more specific details tell us some more specific information about your system and its functionalities.

Rgds,
Alex

[Ralph Grothe · Accepted solution]

Hi Pedro,

it depends on the purpose of your host.

There's been quite a good document about hardening a HP-UX 11 host like for a DMZ bastion host reappearing on various websites.

Here is one of those links:

http://www.unixadm.net/hp/bastioning_hpux.11.html


You may get some ideas of what could be done to increase services' security.

Also you could try the program Bastille which I read about will aid in hardening.
It even might be on the HP's Internet Express.

You could also run checks from a Nessus server against your host.
Nessus has tons of plug-ins for all kinds of security checks.
And if your still dissatesfied it has an own interpreter with syntax close to C that would enable you to write your own check plug-ins.

[Ralph Grothe]

Addendum,
HP already have included Bastille in their toolbox as I found out here

http://docs.hp.com/en/5990-6737/ch07s06.html

and they also included Nessus in their Internet Express

http://docs.hp.com/en/5990-8580/ch01s02.html

[Pedro Tapia_2]

First that nothing, thank you very much by the attention and its answers. The server is rp7410 with HP-UX 11.11 and IBM Informix 7.31 FD8 as database engine. This server this within my LAN and supports to applications Client/Server and WEB. The users in a 95% connect via ODBC
Thanks

[Robert Fritz]

If I could make a further pith for Bastille.

It comes with 11.23 and up, but is free to download for 11.00 and 11.11;
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

I think it does exactly what you're asking for (disabling services), it is more recent than the Bastion host whitepaper, has an easy-to-use, educational GUI, and can even help you set up a host-based firewall (with IPFilter) to allow you do specify which ports you *want* exposed to the net vs. the other way around. It has ~79 things it does total, including the services disablement you mention.

(can you tell I'm on the Bastille team :-) )

Anyway, let me know if the tool doesn't meet your needs. We're always interested in feedback.