Unix Security

System & Network Security, HP-UX

This document shows system administrators how to better secure their UNIX systems. There are no guarantees of its completeness. In addition, the author takes no responsibility if a person misuses this information. There are many versions of Unix. This paper gives examples for HP-UX.

For a shortened version, please see our security checklist

Physical Security

Often the subject of internal security is overlooked. However, often it is fairly easy for someone to get access to systems they are not supposed to have access by simply walking up to a valid users desk. This can be the cleaning staff or a disgruntled (ex)employee making a visit. This is the easiest type of security to implement and should definitely be included in any security plan.

• Console security
  
  Machines and consoles need to be secure. A person can simply turn off a computer if one has access to it. If they have access to the console, they can often interrupt the boot process to get access to the root prompt. If this doesn't work, they can keep guessing the root password in hopes of compromising the system.
  
  For these reasons (and more), the computers and associated consoles should be kept in a secure room. A limited number of people should have access to this room, of course with a limited number of keys. Some places actually have security guards let people into the computer rooms for guaranteed secure access.
  
  If your data is sensitive, be certain to verify that there are no alternative methods for getting into the room. This includes hidden spare keys in an unsecured place, gaps in the raised floors that go past the locked access point, and space above the ceilings.
  
  
• Data Security
  
  Companies that value their data need a detailed backup recovery scheme. This includes on site backups for least amount of down time, a copy of this data off site in case of computer room disasters, as well as contingency plans in place. Unfortunately, an easy way to get access to a companies data is to gain access to backup tapes and sensitive printouts. Hence, all sensitive information should be stored in locked cabinets. Backup tapes sent off site should be in locked containers. Old sensitive printouts and tapes should be destroyed.
  
  To protect against computer damage from power outages (and spikes), be certain to have your computers on a UPS. This provides consistent power, protects against outages, as well as protects the computer from power spikes. Ideally, there should be a backup generator for production systems. For non-production systems, there should be a automatic way to shutdown the computer if the power has switched to the UPS for more than 1/2 the time the UPS is rated to supply.
  
  To prevent snooping, secure network cables from exposure.
  
  
• Users practice secure measures 
  
  Always have users lock their screen when away from their desk. It is best if they log off of their terminal/workstation at night. There should be no written passwords or password hints on a users desk. If users are using X, verify that they are using xauth/xhost to prevent others from reading their screen.
  
  
• NO welcome banner on site
  
  Court cases have shown that initial banners must NOT say "welcome". 
  
  Your banner should say something like: "Only authorized access allowed; violators will be prosecuted". In addition, change /etc/issue NOT to include the machine type/OS revision.

• IBAN Validation
  
  The IBAN validation service provides additional security for international bank transactions.
• Unix Network Security
  
  Once you put a computer on a network, you allow many more people potential access to the machine.
• Unix Account Security
  
  If your accounts are not secure, then your other steps won't help much. There is general password security as well as special steps to take for each type of account.
• Unix File System Security
  
  File system security is about making sure your users can only do what you want them to be able to do.
• Unix Security Testing
  
  Unix Security is an ongoing process...
• Unix Security Websites
  
  A list of resources to keep your Unix system secure.
• Unix Security Checklist
  
  This document shows system administrators how to secure their systems better...

Amazon.com security references:

Unix/Lunix Security News from Google & Yahoo

Security Measure of Online Backups - American Chronicle

Security Measure of Online Backups American Chronicle,�CA�- Sep 5, 2008 Now if you are concerned about maintaining the data security and integrity with the help of the third party solutions like online data backup, ...

CommVault Simpana Suite Receives Windows Server 2008 Certification - MarketWatch

CommVault Simpana Suite Receives Windows Server 2008 Certification MarketWatch�- 3 hours ago ... including migration functionality that can assist in migrating data from older versions of Windows, UNIX and Linux to Windows Server 2008. , , ) . ...

Torvalds: Fed up with 'security circus' - Computerworld

Torvalds: Fed up with 'security circus' Computerworld,�MA�- Aug 15, 2008 What he does favor is to "have a model where security is easier to do in the first place -- that is, the Unix model -- but make it easy for people to report ...

Security Team Practices Theft by Delusion - Computerworld

Security Team Practices Theft by Delusion Computerworld,�MA�- Aug 25, 2008 These days, it's rare for any of our large disk storage arrays or Unix systems not to have a trailing phone line behind the box. ...

INNOVATION Data Processing Announces Australian Federal Government ... - MarketWatch

INNOVATION Data Processing Announces Australian Federal Government ... MarketWatch�- 4 hours ago The FDRERASE Suite is the sole internationally recognized solution for the secure erasure of LUW (Linux/Unix/Windows) Open Systems and IBM z/OS disk with a ...

Gentoo Linux Security Advisory - dnsmasq: Denial of Service and ... - Help Net Security

Gentoo Linux Security Advisory - dnsmasq: Denial of Service and ... Help Net Security,�Croatia�- Sep 4, 2008 Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. ...

Slackware Security Advisory - php (SSA:2008-247-0) - Help Net Security

Slackware Security Advisory - php (SSA:2008-247-0) Help Net Security,�Croatia�- Sep 4, 2008 +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com ...

SSH Communications Security Launches Consulting Services to Assist ... - PR Newswire (press release)

SSH Communications Security Launches Consulting Services to Assist ... PR Newswire (press release),�NY�- 3 hours ago SSH Tectia products provide transparent, strong encryption and authentication, and are available for all key enterprise platforms including Windows, Unix, ...

Linux security idiots - Computerworld

Internet Monitor

Linux security idiots Computerworld,�MA�- Aug 27, 2008 Linux really is more secure than most operating systems, but, as the security mantra goes, "security is a process, not a product. ... US-CERT Confirms Attacks Using Stolen SSH Keys CRN Linux Systems Being Hit By SSH-Key Attacks InformationWeek Linux Under Attack! EFYTimes (press release) ZDNet UK�- CNET News all 15 news articles

An open source rootkit kit - ZDNet

An open source rootkit kit ZDNet�- Sep 5, 2008 While it's true that the program can make rootkits, I don't see it as a net loss for Linux security. I think it may be more of a honeypot. ...