What are all the ways an HPUX system can be accessed?

[Angie_1]

I am trying to come up with a list of ALL the different ways an HPUX 11.X system can be accessed via the network. I then have to write a document on how we are controlling them.

I have the following:

ftp
telnet
remsh
rexec

Am I missing anything?

Thanks - Angie

[Rodney Hills]

Check out the file /etc/services for some others.

finger
http

are also pretty common

HTH

-- Rod Hills

[Nick Wickens · Accepted solution]

Take a look at /etc/services - They are all potential access ports.

You may also have odbc access enabled through database engines or Web Browser access to applications AND hardware (eg the console).

[Angie_1]

Good idea. Will look at that file. I am having to do this because of Sarbanes!

Angie

[Zinky]

Others to add to your list:

Webmin
VNC
SAMBA

And the various Enterprise Monitoring Suites like BMC Patrol, ITO and CA Unicenter.

[Denver Osborn]

keep in mind that there could be a process listens for requests and may not be listed in /etc/services or inetd.conf... ie/ sshd and mysqld.... etc.

you could use lsof and netstat to see what process is listening on what port.

# netstat -an |grep LISTEN

tcp 0 0 *.22 *.* LISTEN

# lsof -i:22
would show sshd on port 22


hope this helps
-denver

[Angie_1]

Ok thanks... now I will figure out how to control/block all these.

Then document. YUCK!

Angie

[Fred Ruffet]

You'll only have to report on open ports. Use netstat to see on wich port your server is listening. Your server is hoppefuly not listening for all protocols defined in /etc/services :)
If you have a firewall, don't deal with blocked ports.

Regards,

Fred

[Angie_1]

Ok I will use netstat to see what all ports are open. I think I am more interested in looking at not the open ports or services on those open ports, but a way to stop a user from logging in directly. Know what I mean?

Wouldn't it then be just the telnet, rexec, ftp, remsh...and?

Angie

[Fred Ruffet]

Knowing listening ports (with netstat), you will have a look in /etc/services to know what program is using this port. That will tell you what program can be used to connect.

lsof is even the better way, because it will tell you program/ports binding regardless of /etc/services. So it wil not fail for programs not using default ports.

Regards,

Fred

[A. Clay Stephenson]

One missing from your list is rlogin but you really do have to netstat and/or lsof to look for listeners. After all just because someone didn't name their daemon telnetd and just because the client isn't connecting on port 23 doesn't mean that someone hasn't created a server process that listens on another port which behaves like telnetd.

Even the well-known services might be vulnerable to buffer-overflow attacks or denial-of-service attacks.

[Steven E. Protter]

ssh
sftp
scp

The replacement for the r-protocols.

Safe, secure, no clear text transmission of passwords.

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

SEP

[Angie_1]

Where is lsof as I can't find it on my HPUX 11.X box.

Thanks!
Angie

[A. Clay Stephenson]

Lsof (list open files) doesn't come as a standard HP-UX utility. It's available on any of the HP-UX Porting Centre's and it a tool no UNIX box should be without.

http://gatekeep.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.73/

[Mark Greene_1]

lsof can be downloaded from here:

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.73/


also access methods like UUCP, tftp, and Kermit, though not widely used, are still available.


mark

[Angie_1]

Thanks for that link for lsof. Will try that out today!

THANK YOU!!!!!!
Angie

[Robert-Jan Goossens_1]

Hi Angie,

Not the most obvious one, but access to the console is one of the most risky one.

Hope it helps,
Robert-Jan

[Angie_1]

Thank you all!!

Angie