/var/adm/sw/save world writable???

[Marco Santerre]

Hello gurus,

quick question : I'm having an issue with compliancy to security where when some patches are installed, it saves the filesets and directories under /var/adm/sw/save but with world writable security on it.

Is there a way to get rid of that automatically? I mean without intervention of SA? Either through SD or with a switch that we set up previously?

Thanks

[Steven E. Protter]

Shalom,

I'd just have the sysadmin fix it.

Its not like there is a lot of usable data there.

HP-UX has never been sold as a secure OS, but rather a secureable OS, that can be made secure with good system administration.

SEP

[A. Clay Stephenson · Accepted solution]

You can greatly restrict the permissions on /var/admsw/save to simply 500 owned by root:sys. Root, the user (or effective user) running any swxxxx command, will not need write permission to create new directories because permissions are ignored by root. This will effectively isolate any files below that directory level from ordinary users. However, files below that level should be left intact because if a patch has to be uninstalled, it's important that the files be put back in their original state. I've never had any difficultly explaining this to the security auditors and as long as they see the higher level directory permissions prevent anyone except root from accessing these files, they give their okey-dokey.

[Pete Randall]

Marco,

I find this quite odd. My save directory has 500 root:sys permissions and every saved patch within has 755 root:sys permissions. I would suggest changing yours and monitoring.


Pete

[Geoff Wild]

/var/adm/sw/save should be 500 and everything under it 755 with root:sys.

Also, root umask should be 022

Rgds...Geoff

[Marco Santerre]

Thanks for all the info.

I don't plan to toy very much with it, but in order for our SOX compliancy to go through and help us out, we have a tool that we use and it found out that a lot of the OVO patches have world writable directories under their saved patch and the software does pick it up as a "hole" in our security.

my /var/adm/sw/save is also owned by root:sys at 500, and all other patches do come through as 755.

[A. Clay Stephenson]

Exactly what I was saying. This will require about a 5 sentence paragraph in your assessment to explain that it is important that the files under /var/adm/sw/save be left intact so that patch rollbacks restore files EXACTLY as they were.

[Marco Santerre]

Thanks to all of you for helping me

[Robert Fritz]

Note that HP-UX Bastille can help with world-writeable directories, and other lockdown steps (ref: the "secureable" comment earlier)