 |
» |
|
|
|
Beginning with HP-UX
11i v2, HP-UX Bastille (B6849AA) is included as default-installed software on the Operating
Environment media and can be installed with Ignite-UX or Update-UX. HP-UX Bastille is a security hardening/lockdown tool that
can be used to enhance security of the HP-UX operating system. It
provides customized lockdown on a system-by-system basis by encoding
functionality similar to Bastion Host and other hardening/lockdown
checklists. | | | |  | NOTE: For more information about HP-UX Bastille, see the HP-UX 11i Version 2 Release Notes and Managing Systems and Workgroups. | | | | |
At install- or update-time, you can choose one of the following
security configuration bundles with each bundle providing incrementally
higher security: Table 2-2 Predefined Security Configuration Bundles Bundle Name | Configuration File Name[1] | Description |
|---|
Sec00Tools[2] | - | The install-time security infrastructure; no
security changes | Sec10Host[3] | HOST.config | Host-based lockdown: no firewall; many
some common clear-text services turned off, excluding Telnet and FTP | Sec20MngDMZ[3] | MANDMZ.config | Lockdown: IPFilter firewall blocks incoming connections
except common, secured, management protocols | Sec30DMZ[3] | DMZ.config | Full lockdown: IPFilter blocks all incoming connections
except HP-UX Secure Shell |
Security
Choice Dependencies | |
The Sec00Tools security infrastructure bundle is default-installed
on your system. While this bundle does not implement any security
changes at install- or update-time, it does ensure that the required
software (see Figure 2-1 “Install-time Security Software Dependencies”) is installed.
By installing Sec00Tools, you can opt to run HP-UX Bastille at a later time to
lock down your system. Alternately, you can lock down your system using one of the
following selectable security configuration bundles at install-
or update-time: These bundles are dependent on the Sec00Tools bundle. Secured
Services and Protocols | |
Each security configuration
bundle provides incrementally higher security by locking down various
protocols and services. HP-UX Bastille uses a series of questions
to determine which services and protocols to secure. Using one of
the Install-time Security Configuration bundles applies a default
security profile, simplifying the lockdown process. The following tables detail the services and protocols affected
by the security bundles, listed in Table 2-2 “Predefined Security Configuration Bundles”, if you choose to apply one at install- or update-time. Table 2-3
lists the security settings for Sec10Host. These settings also apply to Sec20MngDMZ and Sec30DMZ Table 2-4
lists the security settings applied with Sec20MngDMZ, additional to the settings in
Table 2-3 Table 2-5
lists the security settings applied with Sec30DMZ. These settings are additional to the settings applied
in Table 2-3 and Table 2-4
Table 2-3 Host-based Sec10Host Install-time Security Settings[1] Category | Actions |
|---|
Logins and Passwords | | Deny login unless home
directory exists | | Deny non-root logins if /etc/nologin file exists | | Set a default path for su command | | Disable root logins from network tty | | Hide encrypted passwords | | Disallow ftpd system account logins | | Disable remote X logins |
| File System, Network, and Kernel | | Modify ndd settings [2],[3] | | Restrict remote access to swlist | | Set default umask | | Enable kernel-based stack execute protection |
| Daemons | | Disable ptydaemon | | Disable pwgrd | | Disable rbootd | | Disable NFS client daemons | | Disable NFS server | | Disable NIS client programs | | Disable NIS server programs | | Disable SNMPD |
| inetd Services | | Deactivate bootp | | Deactivate inetd’s built-in
services | | Deactivate CDE helper services | | Deactivate finger | | Deactivate ident | | Deactivate klogin and kshell | | Deactivate ntalk | | Deactivate login, shell,
and exec services | | Deactivate swat | | Deactivate printer | | Deactivate recserv | | Deactivate tftp | | Deactivate time | | Deactivate uucp | | Enable logging for all inetd connections |
| sendmail | | Run sendmail via cron to process queue | | Stop sendmail from running in daemon mode | | Disable vrfy and expn commands |
| Other Settings | | Deactivate HP Apache 2.x
Web Server[4] | | Set up cron job to Security Patch Check[2] |
|
Table 2-4 Additional Sec20MngDMZ Install-time Security Settings[1] Category | Actions |
|---|
inetd Services | Includes all disabled inetd services in Table 2-3 and: | Deactivate ftp | | Deactivate telnet |
| IPFilter Configuration[2] | | Block incoming DNS query
connections | | Block incoming HIDS administration connections[3],[4] | | Configure IPFilter to allow outbound traffic, block incoming
traffic with IP options set, and all other traffic except for HP-UX
Secure Shell, HIDS agent, WBEM, web admin and web admin autostart.[5] |
|
Table 2-5 Additional Sec30DMZ Install-time Security Settings[1] Category | Actions |
|---|
IPFilter Configuration[2] | Includes all IPFilter settings in Table 2-4
and: | Block incoming HIDS agent connections[3],[4] | | Block incoming WBEM connections[5] | | Block incoming web admin connections | | Block incoming web admin autostart connections | | Block all traffic except HP-UX Secure Shell |
|
|
Printable version
