HP-UX 11i Security

CHRIS WONG has worked on HP systems since the mid-1980s. She is a HP Certified Technical Professional/Consultant on HP-UX 11, the HP e3000, High Availability, System Consolidation, and the XP. She is also a HP OpenView Certified Consultant and Integration Expert. Currently, she is a technical consultant for Cerius Technology Group, an HP Channel Partner.

Foreword.


Preface.


1. Ready or Not, Here I Come!


Attacks. What Is Needed to Compromise a System? Ten Ways To Become root. What Can Happen When the System Is Compromised? Protection. A Letter to the CIO. Policies.



2. Passwords, Users, and Groups.


The password File. The Group File. Tools. Security Risk of the /etc/passwd File. Trusted System. Trusted Systems and Tools. Password Policies. What Makes a Good Password? Passwords and Multiple Hosts. User Management. Group Maintenance. Writing Scripts. The /etc/default/security File.



3. Disks, File Systems, and Permissions.


Disks. Logical Volume Manager. VERITAS Volume Manager. File Systems. The mount Command. File Permissions. Access Control Lists. The chatr Command and the Executable Stack. Quotas. The NAS and SAN.



4. System Access.


The Internet Daemon. Modems. The /etc/dialups and /etc/d_passwd Files. Secure Web Console. Physical Access and Boot Authentication. Guardian Service Processor. Restrictions for Users.



5. Multi-Host Environments.


The “r” Commands. SSH. NIS. NIS+. LDAP. DNS and BIND. DHCP. NFS. CIFS/9000.



6. Distributing root Privileges.


SUID/SGID Scripts and Programs. Restricted SAM. Sudo. ServiceControl Manager. OpenView. Comparison of Tools.



7. ServiceControl Manager.


Installation of the Central Management Server. Adding Nodes to the SCM Cluster. ServiceControl Manager Graphical User Interface. Adding Users. Role Assignments. Tools. Argument Limitations. Web Interface. SCM Log Files. SCM and Security. Why Use SCM?



8. Internet Daemon Services.


The Internet Daemon Startup. /etc/inetd.conf File. /etc/services File. /etc/protocols File. /var/adm/inetd.sec File. Understanding Socket Connections. Tcpwrappers. Telnet. File Transfer Protocol. Anonymous FTP. Trivial FTP. Finger. Other Internet Services. Running Other Services from inetd.



9. Kerberos.


What is Kerberos Doing? Installing Kerberos. Configuring Kerberos. Kerberos Utilities. Kerberos and HP-UX 10.20. Kerberos and rlogin. Kerberos and the -P Option. More about PAM.



10. IPSec/9000.


IPSec Configuration. What Is Happening? IPSec Tunnel Mode. Using IPSec/9000 as a Firewall. IP Number and Mask. Managing Keys on IPSec/9000.



11. Monitoring System Activity.


syslog Daemon. The syslog File. The btmp File. The wtmp File. The /etc/utmp File. The sulog File. The rc.log File. Shell History. Open Source Log Tools and Utilities. Log Rotation. Auditing. Accounting. Utilizing Performance Data. Monitoring System Resources. Managing System Resources.



12. Monitoring System Changes.


System Configuration Repository. Tripwire.



13. NetAction.


HP VirtualVault. Extranet VPN. HP Speedcard. HP PKI. Intrusion Detection System/9000.



14. Building a Bastion Host by Kevin Steves.


What Is a Bastion Host? Methodology. Sample Blueprint.



15. Checklist, Security Patches, and Miscellaneous Topics.


The Checklist. The HP-UX Security Patch Check Tool. The HP-UX Security Book Web Site. Continuing Your Knowledge. Mail. Protecting Your System Against “Ten Ways to Become root”. The Bastille Hardening System. IPFilter/9000.



Index.