what should i do to make sure boxes' security

[thebeatlesguru]

which files in box should config to make sure security,and can you give me some examples ?

[Bill McNAMARA_1 · Accepted solution]

I'd start by searching for
Bastion Firewall in the forums.

There is a doc that describes this process.

Then get the security patch check from software.hp.com and change permissions according to it's report.

Then apply a password at the BCH level.

Then lock the server with key.

Then Lock the server into a secure room (keycoded)

Then change the root password (and all other users passwords) every week.

Later,
Bill

[S.K. Chan]

Some examples ..

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x11b079bffde7d4118fef0090279cd0f9,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x2ec453921f1ad5118fef0090279cd0f9,00.html

[Peter Kloetgen]

Hi Thebeatlesguru,

very important are some of the following steps:

- take care, that you have the newest Patches installed which have level "Security".
- take care you have properly set permissions for system critical files like /etc/passwd (444)
- take care you have a "good" root- password, which you change periodically
- if necessary, implement password restrictions for your users also ( password aging, history and so on )
- take care, that NOBODY is able to get physically to your servers who does not need to! ( mashine guns and mines help here... )
- disable remote root- connections, allow only for your needs a local switch-user to root ( su - )
- don't connect with telnet as root, use tools like Reflection X or Hummingbird exceed, which use data encryption!

If you did these steps, a lot of the security problems are no longer existant.

Allways stay on the bright side of life!

Peter

[Animesh Chakraborty]

Hi,
You can convert your systems in trusted mode.
Go to SAM to convert the system into trusted mode.

[K.Vijayaragavan.]

Hi guru,

some of the files which needs confiuration and proper permission set to ensure security are as follows,

1)/etc/securetty
2)/etc/ftpaccess
3)/var/adm/inetd.sec
4)/tcb/files/auth
5)/etc/dt/config/Xaccess
6)/etc/exports
7).rhosts
8)/etc/shutdown.allow
9)/var/adm/cron/at.allow
10)/var/adm/cron/cron.allow
11)/etc/hosts.equiv
12)/etc/inetd.conf
12)/etc/hosts
13)/etc/passwd

-Vijay

[Roger Baptiste]

Hi,

this document is a good starting point

http://people.hp.se/stevesk/bastion10.html

HTH
raj